Change in vdsm[master]: mkimage: do not create world-readable image

danken at redhat.com danken at redhat.com
Mon Jan 20 06:49:46 UTC 2014


Dan Kenigsberg has submitted this change and it was merged.

Change subject: mkimage: do not create world-readable image
......................................................................


mkimage: do not create world-readable image

mkimage generates world-readable images by default.
mkimage spawns a genisoimage process through the cpopen package
to do the actual work.
It is of course possible to fix the permissions once the ISO image
is created with a trivial os.chmod() call, but this will leave
open a window opportunity to still exploit the bug.
A more correct and secure way to fix the permissions of the newly
generated image is to setup the umask just before to exec.

The current python-cpopen package lacks a way to set the umask
of the child before to run it, so this patch depends on an enhanced
python-cpopen, temporarily located here:

https://github.com/mojaves/python-cpopen

With this enhanced cpopen, fixing the permissions is trivially made
by passing the correct umask at the ISO image creation.

PatchSet v2:
the cpopen patch has been merged upstream:

https://github.com/ficoos/cpopen/commits/master

PatchSet v3:
* updated vdsm.spec.in and debian.control to require an updated cpopen.

PatchSet v4:
* the minimum required cpopen version is 1.2.3-5

PatchSet v5:
* rebased against master
* make iso image not group-writable
* added explicit permission tests (umask tests alread committed
  in the cpopen package)

Change-Id: I893a1310d9988c52cec9f48dfd17dfa1647da4dc
Bug-Url: https://bugzilla.redhat.com/1034172
Signed-off-by: Francesco Romani <fromani at redhat.com>
Reviewed-on: http://gerrit.ovirt.org/21946
Reviewed-by: Yaniv Bronhaim <ybronhei at redhat.com>
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M debian/control
M lib/vdsm/utils.py
M tests/mkimageTests.py
M vdsm.spec.in
M vdsm/mkimage.py
5 files changed, 17 insertions(+), 5 deletions(-)

Approvals:
  Yaniv Bronhaim: Looks good to me, but someone else must approve
  Dan Kenigsberg: Looks good to me, approved
  Francesco Romani: Verified



-- 
To view, visit http://gerrit.ovirt.org/21946
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I893a1310d9988c52cec9f48dfd17dfa1647da4dc
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Antoni Segura Puimedon <asegurap at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Saggi Mizrahi <smizrahi at redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>


More information about the vdsm-patches mailing list