FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora Development

 
 
LinkBack Thread Tools
 
Old 03-30-2011, 08:27 PM
Chris Lumens
 
Default crypttab should not be work-readable (#692254).

---
pyanaconda/storage/__init__.py | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/pyanaconda/storage/__init__.py b/pyanaconda/storage/__init__.py
index 472627c..90bc2b0 100644
--- a/pyanaconda/storage/__init__.py
+++ b/pyanaconda/storage/__init__.py
@@ -2239,6 +2239,7 @@ class FSSet(object):
crypttab_path = os.path.normpath("%s/etc/crypttab" % instPath)
crypttab = self.crypttab()
open(crypttab_path, "w").write(crypttab)
+ os.chmod(crypttab_path, 0600)

# /etc/mdadm.conf
mdadm_path = os.path.normpath("%s/etc/mdadm.conf" % instPath)
--
1.7.4.1

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/anaconda-devel-list
 
Old 03-30-2011, 10:28 PM
"Brian C. Lane"
 
Default crypttab should not be work-readable (#692254).

On Wed, Mar 30, 2011 at 04:27:06PM -0400, Chris Lumens wrote:
> ---
> pyanaconda/storage/__init__.py | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/pyanaconda/storage/__init__.py b/pyanaconda/storage/__init__.py
> index 472627c..90bc2b0 100644
> --- a/pyanaconda/storage/__init__.py
> +++ b/pyanaconda/storage/__init__.py
> @@ -2239,6 +2239,7 @@ class FSSet(object):
> crypttab_path = os.path.normpath("%s/etc/crypttab" % instPath)
> crypttab = self.crypttab()
> open(crypttab_path, "w").write(crypttab)
> + os.chmod(crypttab_path, 0600)
>
> # /etc/mdadm.conf
> mdadm_path = os.path.normpath("%s/etc/mdadm.conf" % instPath)
> --
> 1.7.4.1

Under normal installer conditions this works fine, but if the storage
module ends up being used by something outside anaconda there is a race
condition for access to the file. It would probably be safer to do:

origmask = os.umask(0077)
open(crypttab_path, "w").write(crypttab)
os.umask(origmask)

so that the file never exists with world readable permissions.

--
Brian C. Lane | Anaconda Team | IRC: bcl #anaconda | Port Orchard, WA (PST8PDT)
_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/anaconda-devel-list
 
Old 03-31-2011, 02:00 PM
Chris Lumens
 
Default crypttab should not be work-readable (#692254).

> Under normal installer conditions this works fine, but if the storage
> module ends up being used by something outside anaconda there is a race
> condition for access to the file. It would probably be safer to do:
>
> origmask = os.umask(0077)
> open(crypttab_path, "w").write(crypttab)
> os.umask(origmask)
>
> so that the file never exists with world readable permissions.

Changed.

- Chris

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/anaconda-devel-list
 

Thread Tools




All times are GMT. The time now is 07:43 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org