[Automatic Bug Reporting Tool - ABRT] #927: move dump location from /var/spool/abrt to /var/tmp/abrt
by fedora-badges
#927: move dump location from /var/spool/abrt to /var/tmp/abrt
--------------------+------------------------------
Reporter: jfilak | Owner: crash-catcher@…
Type: task | Status: new
Priority: major | Milestone:
Component: abrt | Version:
Keywords: | Blocked By:
Blocking: |
--------------------+------------------------------
== Rationale ==
Get rid of directory stealing.
----
== FHS compliance (current state) ==
We have been saving dump directories in '/var/spool/abrt' because we
wanted to
be complaint with FHS (we consider dump directory as a data waiting to be
reported). For good security reasons users are not allowed to add new
files to
dump directory or write into existing dump directory files (e.g. wasting
of all
root FS free space).
'''Implementation'''
- set dump directory uid to abrt's user id because we want to allow abrt
binaries to process dump directories.
- set dir's gid to crashed application's user gid because we want to
remember who experienced the problem.
- (just for the record: we can't set dir's uid to crashed
application's user uid because owner can modify dir's rights).
'''Advantages'''
- great safeness
- arguable FHS compliance
'''Disadvantages'''
- leads to '''stealing of directories''' because events require write
access to a
dump directory and events are run under non root (abrt) user while
reporting (no write access by default).[[BR]]
''Consequences:''
- broken local duplicate detection (if a problem has been stolen the
second
occurrence is not recognized as duplicate)
- root can't see stolen problems
- and few more difficulties
- group members can see crashes of other group members.
Institutions like schools uses one common group for all students.
----
== Partial FHS compliance (proposal) ==
In order to avoid struggling with FHS compliance disadvantages we grant
users
ownership of dump directories (give them read/write access). But we can't
allow
users to have write acces in '/var/spool/abrt', therefore we have to place
dump
location in '/var/tmp/abrt'
'''Implementation'''
- set dump dir's uid to crashed application's user uid, and we set gid
to
abrt's group id.
- allow write access to group because we want to allow abrt
binaries to process dump directories.
'''Advantages'''
- no Strong Security disadvantages
'''Disadvantages'''
- arguable safeness (?)
- in order to protect file system the dump directories must be saved in
'/var/tmp/abrt'
- arguable FHS compliance
--
Ticket URL: <https://fedorahosted.org/abrt/ticket/927>
Automatic Bug Reporting Tool - ABRT <http://fedorahoted.org/abrt/>
Automatic bug reporting tool
11 years, 2 months
[LIBREPORT PATCH] rhbz: replace obsolete methods by their substitutes
by Jakub Filak
- due to changes described here http://post-office.corp.redhat.com/archives/bugzilla-development-list/201...
- replaced RPC method names:
- bugzilla.getBug -> Bug.get
- bugzilla.addAttachment -> Bug.add_attachment
- works with:
- https://bugzilla.redhat.com/ [version 4.2.4-7]
- https://partner-bugzilla.redhat.com/ [version 4.2.4-7]
- https://bzweb01-devel.app.eng.rdu.redhat.com/ [version 4.4.rc1.b02]
- closes trac#921
Signed-off-by: Jakub Filak <jfilak(a)redhat.com>
---
src/plugins/rhbz.c | 121 +++++++++++++++++++++++++++++++++++++++++++----------
src/plugins/rhbz.h | 2 +
2 files changed, 100 insertions(+), 23 deletions(-)
diff --git a/src/plugins/rhbz.c b/src/plugins/rhbz.c
index 33fafa4..1892968 100644
--- a/src/plugins/rhbz.c
+++ b/src/plugins/rhbz.c
@@ -68,19 +68,47 @@ void free_bug_info(struct bug_info *bi)
free(bi);
}
-static GList *parse_comments(xmlrpc_value *result_xml)
+static GList *rhbz_comments(struct abrt_xmlrpc *ax, int bug_id)
{
func_entry();
- GList *comments = NULL;
- xmlrpc_value *comments_memb = rhbz_get_member("longdescs", result_xml);
- if (!comments_memb)
- return NULL;
+ /* http://www.bugzilla.org/docs/4.2/en/html/api/Bugzilla/WebService/Bug.html... */
+ /*
+ * <methodResponse>
+ * <params><param>
+ * <value><struct>
+ * <member><name>bugs</name>
+ * <value><struct>
+ * <member><name>BUG_ID</name>
+ * <value><struct>
+ * <member><name>comments</name>
+ * <value><array>
+ * ...
+ */
+ xmlrpc_value *xml_response = abrt_xmlrpc_call(ax, "Bug.comments", "({s:(i)})",
+ "ids", bug_id);
- int comments_memb_size = rhbz_array_size(comments_memb);
+ /* bugs
+ * This is used for bugs specified in ids. This is a hash, where the
+ * keys are the numeric ids of the bugs, and the value is a hash with a
+ * single key, comments, which is an array of comments.
+ */
+ xmlrpc_value *bugs_memb = rhbz_get_member("bugs", xml_response);
+
+ /* Get hash value assigned to bug_id key */
+ char *item = xasprintf("%d", bug_id);
+ xmlrpc_value *item_memb = rhbz_get_member(item, bugs_memb);
+ free(item);
+
+ /* Get array of comments */
+ xmlrpc_value *comments_memb = rhbz_get_member("comments", item_memb);
xmlrpc_env env;
xmlrpc_env_init(&env);
+
+ int comments_memb_size = rhbz_array_size(comments_memb);
+
+ GList *comments = NULL;
for (int i = 0; i < comments_memb_size; ++i)
{
xmlrpc_value* item = NULL;
@@ -88,12 +116,21 @@ static GList *parse_comments(xmlrpc_value *result_xml)
if (env.fault_occurred)
abrt_xmlrpc_die(&env);
- char *comment_body = rhbz_bug_read_item("body", item, RHBZ_READ_STR);
+ char *comment_body = rhbz_bug_read_item("text", item, RHBZ_READ_STR);
/* attachments are sometimes without comments -- skip them */
if (comment_body)
comments = g_list_prepend(comments, comment_body);
+
+ xmlrpc_DECREF(item);
}
+ xmlrpc_env_clean(&env);
+
+ xmlrpc_DECREF(comments_memb);
+ xmlrpc_DECREF(item_memb);
+ xmlrpc_DECREF(bugs_memb);
+ xmlrpc_DECREF(xml_response);
+
return g_list_reverse(comments);
}
@@ -239,6 +276,23 @@ int rhbz_array_size(xmlrpc_value *xml)
return size;
}
+xmlrpc_value *rhbz_array_item_at(xmlrpc_value *xml, int pos)
+{
+ func_entry();
+
+ xmlrpc_env env;
+ xmlrpc_env_init(&env);
+
+ xmlrpc_value* item = NULL;
+ xmlrpc_array_read_item(&env, xml, pos, &item);
+ if (env.fault_occurred)
+ abrt_xmlrpc_die(&env);
+
+ xmlrpc_env_clean(&env);
+
+ return item;
+}
+
unsigned rhbz_version(struct abrt_xmlrpc *ax)
{
func_entry();
@@ -408,28 +462,42 @@ struct bug_info *rhbz_bug_info(struct abrt_xmlrpc *ax, int bug_id)
func_entry();
struct bug_info *bz = new_bug_info();
- xmlrpc_value *xml_bug_response = abrt_xmlrpc_call(ax, "bugzilla.getBug",
- "(i)", bug_id);
- int *ret = (int*)rhbz_bug_read_item("bug_id", xml_bug_response,
+ /* http://www.bugzilla.org/docs/4.2/en/html/api/Bugzilla/WebService/Bug.html...
+ *
+ * <methodResponse>
+ * <params>
+ * <param><value><struct>
+ * <member><name>faults</name><value><array><data/></array></value></member>
+ * <member><name>bugs</name>
+ * <value><array><data>
+ * ...
+ */
+ xmlrpc_value *xml_bug_response = abrt_xmlrpc_call(ax, "Bug.get", "({s:(i)})",
+ "ids", bug_id);
+
+ xmlrpc_value *bugs_memb = rhbz_get_member("bugs", xml_bug_response);
+ xmlrpc_value *bug_item = rhbz_array_item_at(bugs_memb, 0);
+
+ int *ret = (int*)rhbz_bug_read_item("id", bug_item,
RHBZ_MANDATORY_MEMB | RHBZ_READ_INT);
bz->bi_id = *ret;
free(ret);
- bz->bi_product = rhbz_bug_read_item("product", xml_bug_response,
+ bz->bi_product = rhbz_bug_read_item("product", bug_item,
RHBZ_MANDATORY_MEMB | RHBZ_READ_STR);
- bz->bi_reporter = rhbz_bug_read_item("reporter", xml_bug_response,
+ bz->bi_reporter = rhbz_bug_read_item("creator", bug_item,
RHBZ_MANDATORY_MEMB | RHBZ_READ_STR);
- bz->bi_status = rhbz_bug_read_item("bug_status", xml_bug_response,
+ bz->bi_status = rhbz_bug_read_item("status", bug_item,
RHBZ_MANDATORY_MEMB | RHBZ_READ_STR);
- bz->bi_resolution = rhbz_bug_read_item("resolution", xml_bug_response,
+ bz->bi_resolution = rhbz_bug_read_item("resolution", bug_item,
RHBZ_READ_STR);
- bz->bi_platform = rhbz_bug_read_item("rep_platform", xml_bug_response,
+ bz->bi_platform = rhbz_bug_read_item("platform", bug_item,
RHBZ_READ_STR);
if (strcmp(bz->bi_status, "CLOSED") == 0 && !bz->bi_resolution)
error_msg_and_die(_("Bug %i is CLOSED, but it has no RESOLUTION"), bz->bi_id);
- ret = (int*)rhbz_bug_read_item("dup_id", xml_bug_response,
+ ret = (int*)rhbz_bug_read_item("dup_id", bug_item,
RHBZ_READ_INT);
if (strcmp(bz->bi_status, "CLOSED") == 0
&& strcmp(bz->bi_resolution, "DUPLICATE") == 0
@@ -442,11 +510,13 @@ struct bug_info *rhbz_bug_info(struct abrt_xmlrpc *ax, int bug_id)
bz->bi_dup_id = (ret) ? *ret: -1;
free(ret);
- bz->bi_cc_list = rhbz_bug_cc(xml_bug_response);
+ bz->bi_cc_list = rhbz_bug_cc(bug_item);
- bz->bi_comments = parse_comments(xml_bug_response);
+ bz->bi_comments = rhbz_comments(ax, bug_id);
bz->bi_best_bt_rating = find_best_bt_rating_in_comments(bz->bi_comments);
+ xmlrpc_DECREF(bugs_memb);
+ xmlrpc_DECREF(bug_item);
xmlrpc_DECREF(xml_bug_response);
return bz;
@@ -604,12 +674,17 @@ int rhbz_attach_blob(struct abrt_xmlrpc *ax, const char *bug_id,
xmlrpc_value* result;
int nomail_notify = !!IS_NOMAIL_NOTIFY(flags);
- result = abrt_xmlrpc_call(ax, "bugzilla.addAttachment", "(s{s:s,s:s,s:s,s:s,s:i})",
- bug_id,
- "description", fn,
- "filename", filename,
- "contenttype", (flags & RHBZ_BINARY_ATTACHMENT) ? "application/octet-stream" : "text/plain",
+ /* http://www.bugzilla.org/docs/4.2/en/html/api/Bugzilla/WebService/Bug.html... */
+ result = abrt_xmlrpc_call(ax, "Bug.add_attachment", "({s:(s),s:s,s:s,s:s,s:s,s:i})",
+ "ids", bug_id,
+ "summary", fn,
+ "file_name", filename,
+ "content_type", (flags & RHBZ_BINARY_ATTACHMENT) ? "application/octet-stream" : "text/plain",
"data", encoded64,
+
+ /* Undocumented argument but it works with Red Hat Bugzilla version 4.2.4-7
+ * and version 4.4.rc1.b02
+ */
"nomail", nomail_notify
);
diff --git a/src/plugins/rhbz.h b/src/plugins/rhbz.h
index a6f7204..f16f6e5 100644
--- a/src/plugins/rhbz.h
+++ b/src/plugins/rhbz.h
@@ -80,6 +80,8 @@ xmlrpc_value *rhbz_get_member(const char *member, xmlrpc_value *xml);
int rhbz_array_size(xmlrpc_value *xml);
+xmlrpc_value *rhbz_array_item_at(xmlrpc_value *xml, int pos);
+
int rhbz_get_bug_id_from_array0(xmlrpc_value *xml, unsigned ver);
int rhbz_new_bug(struct abrt_xmlrpc *ax,
--
1.7.11.7
11 years, 2 months
[ABRT PATCH] synchronize default dump dir mode with libreport
by Jakub Filak
- replace magic constant used as thirhd argument of dd_create() fn by
DEFAULT_DUMP_DIR_MODE macro
- assign dd_mode variable from libreport's pc file to DEFAULT_DUMP_DIR_MODE
- related to trac#927
Signed-off-by: Jakub Filak <jfilak(a)redhat.com>
---
configure.ac | 2 ++
src/daemon/Makefile.am | 1 +
src/daemon/abrt-server.c | 2 +-
src/hooks/Makefile.am | 1 +
src/hooks/abrt-hook-ccpp.c | 2 +-
src/plugins/Makefile.am | 2 ++
src/plugins/abrt-dump-oops.c | 4 ++--
src/plugins/abrt-dump-xorg.c | 4 ++--
8 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/configure.ac b/configure.ac
index 8d20b66..8af75d3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -107,12 +107,14 @@ PLUGINS_CONF_DIR='${sysconfdir}/${PACKAGE_NAME}/plugins'
EVENTS_DIR='${sysconfdir}/libreport/events'
EVENTS_CONF_DIR='${sysconfdir}/libreport/events.d'
ENABLE_SOCKET_OR_DBUS='-DENABLE_DBUS=1'
+DEFAULT_DUMP_DIR_MODE=$($PKG_CONFIG --variable=dd_mode libreport)
AC_SUBST(CONF_DIR)
AC_SUBST(VAR_RUN)
AC_SUBST(PLUGINS_CONF_DIR)
AC_SUBST(EVENTS_CONF_DIR)
AC_SUBST(EVENTS_DIR)
+AC_SUBST(DEFAULT_DUMP_DIR_MODE)
# Initialize the test suite.
AC_CONFIG_TESTDIR(tests)
diff --git a/src/daemon/Makefile.am b/src/daemon/Makefile.am
index 423753a..c3892d4 100644
--- a/src/daemon/Makefile.am
+++ b/src/daemon/Makefile.am
@@ -37,6 +37,7 @@ abrt_server_CPPFLAGS = \
-I$(srcdir)/../lib \
$(GLIB_CFLAGS) \
$(LIBREPORT_CFLAGS) \
+ -DDEFAULT_DUMP_DIR_MODE=$(DEFAULT_DUMP_DIR_MODE) \
-D_GNU_SOURCE
abrt_server_LDADD = \
../lib/libabrt.la \
diff --git a/src/daemon/abrt-server.c b/src/daemon/abrt-server.c
index d9b7c66..eb94465 100644
--- a/src/daemon/abrt-server.c
+++ b/src/daemon/abrt-server.c
@@ -103,7 +103,7 @@ static int create_problem_dir(GHashTable *problem_info, unsigned pid)
/* No need to check the path length, as all variables used are limited,
* and dd_create() fails if the path is too long.
*/
- struct dump_dir *dd = dd_create(path, client_uid, 0640);
+ struct dump_dir *dd = dd_create(path, client_uid, DEFAULT_DUMP_DIR_MODE);
if (!dd)
{
error_msg_and_die("Error creating problem directory '%s'", path);
diff --git a/src/hooks/Makefile.am b/src/hooks/Makefile.am
index 982803e..6ce7314 100644
--- a/src/hooks/Makefile.am
+++ b/src/hooks/Makefile.am
@@ -23,6 +23,7 @@ abrt_hook_ccpp_CPPFLAGS = \
-I$(srcdir)/../lib \
-DVAR_RUN=\"$(VAR_RUN)\" \
-DPLUGINS_CONF_DIR=\"$(PLUGINS_CONF_DIR)\" \
+ -DDEFAULT_DUMP_DIR_MODE=$(DEFAULT_DUMP_DIR_MODE) \
$(GLIB_CFLAGS) \
$(LIBREPORT_CFLAGS) \
-D_GNU_SOURCE
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
index 100df3c..086effc 100644
--- a/src/hooks/abrt-hook-ccpp.c
+++ b/src/hooks/abrt-hook-ccpp.c
@@ -657,7 +657,7 @@ int main(int argc, char** argv)
/* use fsuid instead of uid, so we don't expose any sensitive
* information of suided app in /var/spool/abrt
*/
- dd = dd_create(path, fsuid, 0640);
+ dd = dd_create(path, fsuid, DEFAULT_DUMP_DIR_MODE);
if (dd)
{
char *rootdir = get_rootdir(pid);
diff --git a/src/plugins/Makefile.am b/src/plugins/Makefile.am
index 1c479c0..61bb93a 100644
--- a/src/plugins/Makefile.am
+++ b/src/plugins/Makefile.am
@@ -109,6 +109,7 @@ abrt_dump_oops_CPPFLAGS = \
-I$(srcdir)/../lib \
$(GLIB_CFLAGS) \
$(LIBREPORT_CFLAGS) \
+ -DDEFAULT_DUMP_DIR_MODE=$(DEFAULT_DUMP_DIR_MODE) \
-D_GNU_SOURCE
abrt_dump_oops_LDADD = \
$(GLIB_LIBS) \
@@ -122,6 +123,7 @@ abrt_dump_xorg_CPPFLAGS = \
-I$(srcdir)/../lib \
$(GLIB_CFLAGS) \
$(LIBREPORT_CFLAGS) \
+ -DDEFAULT_DUMP_DIR_MODE=$(DEFAULT_DUMP_DIR_MODE) \
-D_GNU_SOURCE
abrt_dump_xorg_LDADD = \
$(GLIB_LIBS) \
diff --git a/src/plugins/abrt-dump-oops.c b/src/plugins/abrt-dump-oops.c
index 8b22ed3..6365006 100644
--- a/src/plugins/abrt-dump-oops.c
+++ b/src/plugins/abrt-dump-oops.c
@@ -119,11 +119,11 @@ static unsigned save_oops_to_dump_dir(GList *oops_list, unsigned oops_cnt)
const char *iso_date = iso_date_string(&t);
/* dump should be readable by all if we're run with -x */
uid_t my_euid = (uid_t)-1L;
- mode_t mode = 0644;
+ mode_t mode = DEFAULT_DUMP_DIR_MODE | S_IROTH;
/* and readable only for the owner otherwise */
if (!world_readable_dump)
{
- mode = 0640;
+ mode = DEFAULT_DUMP_DIR_MODE;
my_euid = geteuid();
}
diff --git a/src/plugins/abrt-dump-xorg.c b/src/plugins/abrt-dump-xorg.c
index 5d9645d..90dae46 100644
--- a/src/plugins/abrt-dump-xorg.c
+++ b/src/plugins/abrt-dump-xorg.c
@@ -70,11 +70,11 @@ static void save_bt_to_dump_dir(const char *bt, const char *exe, const char *rea
const char *iso_date = iso_date_string(&t);
/* dump should be readable by all if we're run with -x */
uid_t my_euid = (uid_t)-1L;
- mode_t mode = 0644;
+ mode_t mode = DEFAULT_DUMP_DIR_MODE | S_IROTH;
/* and readable only for the owner otherwise */
if (!(g_opts & OPT_x))
{
- mode = 0640;
+ mode = DEFAULT_DUMP_DIR_MODE;
my_euid = geteuid();
}
--
1.7.11.7
11 years, 2 months