Change in vdsm[master]: mkimage: do not create world-readable image
danken at redhat.com
danken at redhat.com
Mon Jan 20 06:49:46 UTC 2014
Dan Kenigsberg has submitted this change and it was merged.
Change subject: mkimage: do not create world-readable image
......................................................................
mkimage: do not create world-readable image
mkimage generates world-readable images by default.
mkimage spawns a genisoimage process through the cpopen package
to do the actual work.
It is of course possible to fix the permissions once the ISO image
is created with a trivial os.chmod() call, but this will leave
open a window opportunity to still exploit the bug.
A more correct and secure way to fix the permissions of the newly
generated image is to setup the umask just before to exec.
The current python-cpopen package lacks a way to set the umask
of the child before to run it, so this patch depends on an enhanced
python-cpopen, temporarily located here:
https://github.com/mojaves/python-cpopen
With this enhanced cpopen, fixing the permissions is trivially made
by passing the correct umask at the ISO image creation.
PatchSet v2:
the cpopen patch has been merged upstream:
https://github.com/ficoos/cpopen/commits/master
PatchSet v3:
* updated vdsm.spec.in and debian.control to require an updated cpopen.
PatchSet v4:
* the minimum required cpopen version is 1.2.3-5
PatchSet v5:
* rebased against master
* make iso image not group-writable
* added explicit permission tests (umask tests alread committed
in the cpopen package)
Change-Id: I893a1310d9988c52cec9f48dfd17dfa1647da4dc
Bug-Url: https://bugzilla.redhat.com/1034172
Signed-off-by: Francesco Romani <fromani at redhat.com>
Reviewed-on: http://gerrit.ovirt.org/21946
Reviewed-by: Yaniv Bronhaim <ybronhei at redhat.com>
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M debian/control
M lib/vdsm/utils.py
M tests/mkimageTests.py
M vdsm.spec.in
M vdsm/mkimage.py
5 files changed, 17 insertions(+), 5 deletions(-)
Approvals:
Yaniv Bronhaim: Looks good to me, but someone else must approve
Dan Kenigsberg: Looks good to me, approved
Francesco Romani: Verified
--
To view, visit http://gerrit.ovirt.org/21946
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I893a1310d9988c52cec9f48dfd17dfa1647da4dc
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Antoni Segura Puimedon <asegurap at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Francesco Romani <fromani at redhat.com>
Gerrit-Reviewer: Saggi Mizrahi <smizrahi at redhat.com>
Gerrit-Reviewer: Yaniv Bronhaim <ybronhei at redhat.com>
More information about the vdsm-patches
mailing list