Change in vdsm[master]: Validate VDSM user's sudoer permissions

danken at redhat.com danken at redhat.com
Thu Jan 2 11:29:48 UTC 2014


Dan Kenigsberg has posted comments on this change.

Change subject: Validate VDSM user's sudoer permissions
......................................................................


Patch Set 3: Code-Review-1

(2 comments)

....................................................
File vdsm/vdsm
Line 169:     src = "/dev/urandom"
Line 170:     count = 1
Line 171:     rc = 1
Line 172:     with tempfile.NamedTemporaryFile() as dst:
Line 173:         cmd = [constants.EXT_DD, "if=%s" % src, "of=/tmp/%s" % dst,
It's so sad (and unsafe) that our sudoers rule allows just any dd command. I'd really like to avoid that. Could you use a more specific command for this assertion, such as

  @CHOWN_PATH@ @VDSMUSER@\:@QEMUGROUP

(and add a note that the choice of command is quite arbitrary).
Line 174:                'count=%s' % count]
Line 175:         rc, _, _ = utils.execCmd(cmd, sudo=True)
Line 176: 
Line 177:     if rc != 0:


Line 174:                'count=%s' % count]
Line 175:         rc, _, _ = utils.execCmd(cmd, sudo=True)
Line 176: 
Line 177:     if rc != 0:
Line 178:         syslog.syslog("User VDSM as invalid sudoer rules configuration")
as->has
Line 179:         sys.exit(1)
Line 180: 
Line 181: 
Line 182: if __name__ == '__main__':


-- 
To view, visit http://gerrit.ovirt.org/22888
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I1b1cb66e927f7ed0fcdd1898edd59730322cdeb1
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-Reviewer: sasha.chuzhoy at gmail.com
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list