From 1191d685b3ac1008af3f45fd8099759efb4de37a Mon Sep 17 00:00:00 2001
From: Peter Varkoly <varkoly@suse.com>
Date: Tue, 24 Mar 2020 18:37:15 +0100
Subject: [PATCH 1/2] Predictable tmp file in sapdb-nosha.sh The name is easily
 predicted. Use /var/run instead of /tmp make it secure.

---
 heartbeat/sapdb-nosha.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/heartbeat/sapdb-nosha.sh b/heartbeat/sapdb-nosha.sh
index 06aa65c4b..cee1f7f99 100644
--- a/heartbeat/sapdb-nosha.sh
+++ b/heartbeat/sapdb-nosha.sh
@@ -740,5 +740,5 @@ sidadm="`echo $SID | tr '[:upper:]' '[:lower:]'`adm"
 }
 
 # Set a tempfile and make sure to clean it up again
-TEMPFILE="/tmp/SAPDatabase.$$.tmp"
-trap trap_handler INT TERM
\ No newline at end of file
+TEMPFILE="/var/run/SAPDatabase.$$.tmp"
+trap trap_handler INT TERM

From c6eb0d5de943a3047c4eec211a366372ad9d8c86 Mon Sep 17 00:00:00 2001
From: Peter Varkoly <varkoly@suse.com>
Date: Wed, 25 Mar 2020 11:16:07 +0100
Subject: [PATCH 2/2] Fix predictable tmp file using in some agents.

---
 heartbeat/sapdb-nosha.sh            |  2 +-
 rgmanager/src/resources/oradg.sh    | 10 +++++-----
 tools/ocft/caselib.in               | 10 +++++-----
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/heartbeat/sapdb-nosha.sh b/heartbeat/sapdb-nosha.sh
index cee1f7f99..31b52e7fe 100644
--- a/heartbeat/sapdb-nosha.sh
+++ b/heartbeat/sapdb-nosha.sh
@@ -740,5 +740,5 @@ sidadm="`echo $SID | tr '[:upper:]' '[:lower:]'`adm"
 }
 
 # Set a tempfile and make sure to clean it up again
-TEMPFILE="/var/run/SAPDatabase.$$.tmp"
+TEMPFILE="${HA_RSCTMP}/SAPDatabase.$$.tmp"
 trap trap_handler INT TERM
diff --git a/rgmanager/src/resources/oradg.sh b/rgmanager/src/resources/oradg.sh
index 4674fe1b2..955f93e18 100644
--- a/rgmanager/src/resources/oradg.sh
+++ b/rgmanager/src/resources/oradg.sh
@@ -122,7 +122,7 @@ end;
 select database_role, open_mode from v\$database;
 set heading off;
 set serveroutput off;
-spool /tmp/dgstatus.${ORACLE_SID};
+spool ${HA_RSCTMP}/dgstatus.${ORACLE_SID};
 select open_mode from v\$database;
 spool off;
 EOF
@@ -463,9 +463,9 @@ start_oracle() {
 		fi
 	done
 
-	if [ -n "$ORACLE_HOSTNAME" -a -s /tmp/dgstatus.${ORACLE_SID} ]; then
+	if [ -n "$ORACLE_HOSTNAME" -a -s ${HA_RSCTMP}/dgstatus.${ORACLE_SID} ]; then
         	# Start DB Console if vhost defined and database_role is READ WRITE
-		if cat /tmp/dgstatus.${ORACLE_SID} 2>/dev/null | grep "READ WRITE"; then
+		if cat ${HA_RSCTMP}/dgstatus.${ORACLE_SID} 2>/dev/null | grep "READ WRITE"; then
 			ocf_log info "Starting Oracle EM DB Console for $ORACLE_SID"
 			emctl start dbconsole
 			if [ $? -ne 0 ]; then
@@ -478,7 +478,7 @@ start_oracle() {
 				ocf_log info "Oracle EM DB Console startup for $ORACLE_SID succeeded"
 			fi
 		fi
-                rm -f /tmp/dgstatus.${ORACLE_SID}
+                rm -f ${HA_RSCTMP}/dgstatus.${ORACLE_SID}
 	fi
 
 	if [ -n "$LOCKFILE" ]; then
@@ -619,7 +619,7 @@ status_oracle() {
 # Data Guard Modification 1 - Debug Logging
 case $1 in
 stop | start | status | restart | recover | monitor )
-[ $(id -u) = 0 ] && exec > "/tmp/oradg_${ORACLE_SID}_$1.log" 2>&1
+[ $(id -u) = 0 ] && exec > "${HA_RSCTMP}/oradg_${ORACLE_SID}_$1.log" 2>&1
 set -x
 date
 echo $@
--- resource-agents-4.0.1+git.1495055229.643177f1/tools/ocft/caselib.in.orig	2017-05-17 23:07:09.000000000 +0200
+++ resource-agents-4.0.1+git.1495055229.643177f1/tools/ocft/caselib.in	2020-04-14 14:23:49.678653495 +0200
@@ -93,7 +93,7 @@
 
   aroot=${__OCFT__MYROOT:-$__OCFT__AGENT_ROOT}
 
-  setsid $aroot/$agent $cmd >/tmp/.ocft_runlog 2>&1 &
+  setsid $aroot/$agent $cmd >${HA_RSCTMP}/.ocft_runlog 2>&1 &
   pid=$!
 
   i=0
@@ -111,7 +111,7 @@
     kill -SIGKILL -$pid >/dev/null 2>&1
     echo -n "${__OCFT__showhost}ERROR: The agent was hanging, killed it, "
     echo "maybe you damaged the agent or system's environment, see details below:"
-    cat /tmp/.ocft_runlog
+    cat ${HA_RSCTMP}/.ocft_runlog
     echo
     quit 1
   fi
@@ -174,7 +174,7 @@
   fi
 
   ssh root@$host '/bin/bash 2>&1
-                  sed "s/00/001/g" /tmp/.backbash-log
+                  sed "s/00/001/g" ${HA_RSCTMP}/.backbash-log
                   echo 000
                   echo 1' >$__OCFT__CASES_DIR/${host}_r <$__OCFT__CASES_DIR/${host}_w &
 
@@ -203,8 +203,8 @@
   cat >&$wfd
   cat >&$wfd <<EOF
 
-} >&/tmp/.backbash-log
-sed 's/00/001/g' /tmp/.backbash-log
+} >&${HA_RSCTMP}/.backbash-log
+sed 's/00/001/g' ${HA_RSCTMP}/.backbash-log
 echo 000
 echo 0
 EOF
--- resource-agents-4.0.1+git.1495055229.643177f1/heartbeat/ClusterMon.orig	2020-04-14 14:28:36.034587201 +0200
+++ resource-agents-4.0.1+git.1495055229.643177f1/heartbeat/ClusterMon	2020-04-14 14:30:06.347872806 +0200
@@ -86,7 +86,7 @@
 PID file location to ensure only one instance is running
 </longdesc>
 <shortdesc lang="en">PID file</shortdesc>
-<content type="string" default="/tmp/ClusterMon_${OCF_RESOURCE_INSTANCE}.pid" />
+<content type="string" default="${HA_RSCTMP}/ClusterMon_${OCF_RESOURCE_INSTANCE}.pid" />
 </parameter>
 
 <parameter name="htmlfile" unique="1" required="0">
@@ -94,7 +94,7 @@
 Location to write HTML output to.
 </longdesc>
 <shortdesc lang="en">HTML output</shortdesc>
-<content type="string" default="/tmp/ClusterMon_${OCF_RESOURCE_INSTANCE}.html" />
+<content type="string" default="${HA_RSCTMP}/ClusterMon_${OCF_RESOURCE_INSTANCE}.html" />
 </parameter>
 </parameters>
 
@@ -233,8 +233,8 @@
 fi
 
 : ${OCF_RESKEY_update:="15000"}
-: ${OCF_RESKEY_pidfile:="/tmp/ClusterMon_${OCF_RESOURCE_INSTANCE}.pid"}
-: ${OCF_RESKEY_htmlfile:="/tmp/ClusterMon_${OCF_RESOURCE_INSTANCE}.html"}
+: ${OCF_RESKEY_pidfile:="${HA_RSCTMP}/ClusterMon_${OCF_RESOURCE_INSTANCE}.pid"}
+: ${OCF_RESKEY_htmlfile:="${HA_RSCTMP}/ClusterMon_${OCF_RESOURCE_INSTANCE}.html"}
 
 OCF_RESKEY_update=`expr $OCF_RESKEY_update / 1000`
 
