[initial-setup][rhel7-branch/master/f23-branch][PATCH] Only root should be able to read the initial-setup-ks.cfg file (#1264336)
David Shea
dshea at redhat.com
Fri Sep 18 15:22:54 UTC 2015
On 09/18/2015 11:09 AM, Martin Kolman wrote:
> We are using os.open() so that the file has correct permissions (0600)
> set right from the time when it is created.
>
> Resolves: rhbz#1264336
> Signed-off-by: Martin Kolman <mkolman at redhat.com>
> ---
> initial_setup/__main__.py | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/initial_setup/__main__.py b/initial_setup/__main__.py
> index b7abf4a..3abc1da 100644
> --- a/initial_setup/__main__.py
> +++ b/initial_setup/__main__.py
> @@ -209,9 +209,16 @@ if external_reconfig:
>
> # Write the kickstart data to file
> log.info("writing the Initial Setup kickstart file %s", OUTPUT_KICKSTART_PATH)
> -with open(OUTPUT_KICKSTART_PATH, "w") as f:
> - f.write(str(data))
> -log.info("finished writing the Initial Setup kickstart file")
> +# Make sure that the output kickstart file is only readable by root (0600)
> +try:
> + fd = iutil.eintr_retry_call(os.open, OUTPUT_KICKSTART_PATH, os.O_WRONLY | os.O_CREAT, 0o600)
> +except OSError as e:
> + log.exception("can't open output kickstart file for writing: %s", OUTPUT_KICKSTART_PATH)
> + fd = None
> +if fd is not None:
> + with os.fdopen(fd, "w") as f:
> + f.write(str(data))
> + log.info("finished writing the Initial Setup kickstart file")
>
> # Remove the reconfig file, if any - otherwise the reconfig mode
> # would start again next time the Initial Setup service is enabled
On master you can use iutil.open_with_perm get a regular file handle.
Also you didn't close it.
More information about the anaconda-patches
mailing list