Change in vdsm[master]: Validate VDSM user's sudoer permissions
danken at redhat.com
danken at redhat.com
Thu Jan 2 11:29:48 UTC 2014
Dan Kenigsberg has posted comments on this change.
Change subject: Validate VDSM user's sudoer permissions
......................................................................
Patch Set 3: Code-Review-1
(2 comments)
....................................................
File vdsm/vdsm
Line 169: src = "/dev/urandom"
Line 170: count = 1
Line 171: rc = 1
Line 172: with tempfile.NamedTemporaryFile() as dst:
Line 173: cmd = [constants.EXT_DD, "if=%s" % src, "of=/tmp/%s" % dst,
It's so sad (and unsafe) that our sudoers rule allows just any dd command. I'd really like to avoid that. Could you use a more specific command for this assertion, such as
@CHOWN_PATH@ @VDSMUSER@\:@QEMUGROUP
(and add a note that the choice of command is quite arbitrary).
Line 174: 'count=%s' % count]
Line 175: rc, _, _ = utils.execCmd(cmd, sudo=True)
Line 176:
Line 177: if rc != 0:
Line 174: 'count=%s' % count]
Line 175: rc, _, _ = utils.execCmd(cmd, sudo=True)
Line 176:
Line 177: if rc != 0:
Line 178: syslog.syslog("User VDSM as invalid sudoer rules configuration")
as->has
Line 179: sys.exit(1)
Line 180:
Line 181:
Line 182: if __name__ == '__main__':
--
To view, visit http://gerrit.ovirt.org/22888
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment
Gerrit-Change-Id: I1b1cb66e927f7ed0fcdd1898edd59730322cdeb1
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Yaniv Bronhaim <ybronhei at redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-Reviewer: sasha.chuzhoy at gmail.com
Gerrit-HasComments: Yes
More information about the vdsm-patches
mailing list