from openhpi/Makefile.am (line 134):
$(mkinstalldirs) $(DESTDIR)$(VARPATH)
chmod 777 $(DESTDIR)$(VARPATH)
An attacker could use the /var/lib/openhpi directory to fill up the storage hosting the /var/lib/ directory if quotas are not properly set.
If you have the /var/lib/openhpi dir already on your system, no modifications are made. So you need to delete it before trying installing again to reproduce the issue.
The attached patch fix the dir permissions on creation.
from openhpi/Makefile.am (line 134): $(mkinstalldirs) $(DESTDIR)$(VARPATH) chmod 777 $(DESTDIR)$(VARPATH)
An attacker could use the /var/lib/openhpi directory to fill up the storage hosting the /var/lib/ directory if quotas are not properly set.
If you have the /var/lib/openhpi dir already on your system, no modifications are made. So you need to delete it before trying installing again to reproduce the issue.
The attached patch fix the dir permissions on creation.
Reported by: rdossant