Missing input sanitation in upstart logrotation cronjob

Note - this problem only affects vivid fwics. Further, it does not affect Touch (since that uses Upstart as PID 1).

Fixed in upstart 1.13.2-0ubuntu9, currently in the proposed pocket.

This bug was fixed in the package upstart - 1.13.2-0ubuntu9

---------------
upstart (1.13.2-0ubuntu9) vivid; urgency=medium

  * debian/upstart-bin.upstart.cron.daily: Ensure the session uid matches that
    of the session file itself to stop a user forcing the logrotation of
    another users logs.
 -- James Hunt <email address hidden> Thu, 26 Feb 2015 14:35:41 +0000

I'm not sure whether this is the right place to write this, but those permission checks look really racy - both the file type test and the file owner UID check.
(Besides, I think that an attacker should be able to hardlink a file created by another user into his directory, which would also lead to a bypass of the UID equality check, but I'm not familiar enough with ubuntu to be able to say whether that attack is actually feasible.)

Jann, thanks for the comment; I believe the checks aren't strictly necessary; the grep command used to extract one specific variable with the given legal values is the more important part of this patch.

That said, /run/user is a filesystem in its own right, so cross-mount hardlinks aren't possible, and at least on my system, all the directories are mode 700, so hardlinking to another user's file on the filesystem will be difficult.

Have you thought of anything else in the meantime? Thanks