[initial-setup][rhel7-branch/master/f23-branch][PATCH] Only root should be able to read the initial-setup-ks.cfg file (#1264336)

David Shea dshea at redhat.com
Fri Sep 18 15:22:54 UTC 2015


On 09/18/2015 11:09 AM, Martin Kolman wrote:
> We are using os.open() so that the file has correct permissions (0600)
> set right from the time when it is created.
>
> Resolves: rhbz#1264336
> Signed-off-by: Martin Kolman <mkolman at redhat.com>
> ---
>   initial_setup/__main__.py | 13 ++++++++++---
>   1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/initial_setup/__main__.py b/initial_setup/__main__.py
> index b7abf4a..3abc1da 100644
> --- a/initial_setup/__main__.py
> +++ b/initial_setup/__main__.py
> @@ -209,9 +209,16 @@ if external_reconfig:
>   
>   # Write the kickstart data to file
>   log.info("writing the Initial Setup kickstart file %s", OUTPUT_KICKSTART_PATH)
> -with open(OUTPUT_KICKSTART_PATH, "w") as f:
> -    f.write(str(data))
> -log.info("finished writing the Initial Setup kickstart file")
> +# Make sure that the output kickstart file is only readable by root (0600)
> +try:
> +    fd = iutil.eintr_retry_call(os.open, OUTPUT_KICKSTART_PATH, os.O_WRONLY | os.O_CREAT, 0o600)
> +except OSError as e:
> +    log.exception("can't open output kickstart file for writing: %s", OUTPUT_KICKSTART_PATH)
> +    fd = None
> +if fd is not None:
> +    with os.fdopen(fd, "w") as f:
> +        f.write(str(data))
> +    log.info("finished writing the Initial Setup kickstart file")
>   
>   # Remove the reconfig file, if any - otherwise the reconfig mode
>   # would start again next time the Initial Setup service is enabled

On master you can use iutil.open_with_perm get a regular file handle. 
Also you didn't close it.


More information about the anaconda-patches mailing list