Backport upstream commit 30e19216bf to fix CVE-2026-72694
(CWE-59), a symlink-following chown vulnerability in MRTG's
PID file handling during daemon mode startup.
The fix ensures create_pid() refuses symlinks, creates the
PID file atomically with O_WRONLY|O_CREAT|O_EXCL, and uses
fchown on the open filehandle instead of path-based chown,
preventing a local attacker from redirecting ownership
changes to arbitrary files via a pre-placed symlink.
CVE: CVE-2026-72694
Upstream patches:
- 30e19216bf.patch
Resolves: RHEL-236037
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
