sailesh1993 / rpms / cloud-init

Forked from rpms/cloud-init a year ago
Clone
f25da3
From 2a6b3b5afb20a7856ad81b3ec3da621571c3bec3 Mon Sep 17 00:00:00 2001
f25da3
From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
f25da3
Date: Wed, 20 Oct 2021 10:41:36 +0200
f25da3
Subject: [PATCH] cc_ssh.py: fix private key group owner and permissions
f25da3
 (#1070)
f25da3
f25da3
RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
f25da3
RH-MergeRequest: 12: cc_ssh.py: fix private key group owner and permissions (#1070)
f25da3
RH-Commit: [1/1] b2dc9cfd18ac0a8e1e22a37b1585d22dbde11536 (eesposit/cloud-init-centos-)
f25da3
RH-Bugzilla: 2015974
f25da3
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
f25da3
RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
f25da3
f25da3
commit ee296ced9c0a61b1484d850b807c601bcd670ec1
f25da3
Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
f25da3
Date:   Tue Oct 19 21:32:10 2021 +0200
f25da3
f25da3
    cc_ssh.py: fix private key group owner and permissions (#1070)
f25da3
f25da3
    When default host keys are created by sshd-keygen (/etc/ssh/ssh_host_*_key)
f25da3
    in RHEL/CentOS/Fedora, openssh it performs the following:
f25da3
f25da3
    // create new keys
f25da3
    if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then
f25da3
            exit 1
f25da3
    fi
f25da3
f25da3
    // sanitize permissions
f25da3
    /usr/bin/chgrp ssh_keys $KEY
f25da3
    /usr/bin/chmod 640 $KEY
f25da3
    /usr/bin/chmod 644 $KEY.pub
f25da3
    Note that the group ssh_keys exists only in RHEL/CentOS/Fedora.
f25da3
f25da3
    Now that we disable sshd-keygen to allow only cloud-init to create
f25da3
    them, we miss the "sanitize permissions" part, where we set the group
f25da3
    owner as ssh_keys and the private key mode to 640.
f25da3
f25da3
    According to https://bugzilla.redhat.com/show_bug.cgi?id=2013644#c8, failing
f25da3
    to set group ownership and permissions like openssh does makes the RHEL openscap
f25da3
    tool generate an error.
f25da3
f25da3
    Signed-off-by: Emanuele Giuseppe Esposito eesposit@redhat.com
f25da3
f25da3
    RHBZ: 2013644
f25da3
f25da3
Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
f25da3
---
f25da3
 cloudinit/config/cc_ssh.py |  7 +++++++
f25da3
 cloudinit/util.py          | 14 ++++++++++++++
f25da3
 2 files changed, 21 insertions(+)
f25da3
f25da3
diff --git a/cloudinit/config/cc_ssh.py b/cloudinit/config/cc_ssh.py
f25da3
index 05a16dbc..4e986c55 100755
f25da3
--- a/cloudinit/config/cc_ssh.py
f25da3
+++ b/cloudinit/config/cc_ssh.py
f25da3
@@ -240,6 +240,13 @@ def handle(_name, cfg, cloud, log, _args):
f25da3
                 try:
f25da3
                     out, err = subp.subp(cmd, capture=True, env=lang_c)
f25da3
                     sys.stdout.write(util.decode_binary(out))
f25da3
+
f25da3
+                    gid = util.get_group_id("ssh_keys")
f25da3
+                    if gid != -1:
f25da3
+                        # perform same "sanitize permissions" as sshd-keygen
f25da3
+                        os.chown(keyfile, -1, gid)
f25da3
+                        os.chmod(keyfile, 0o640)
f25da3
+                        os.chmod(keyfile + ".pub", 0o644)
f25da3
                 except subp.ProcessExecutionError as e:
f25da3
                     err = util.decode_binary(e.stderr).lower()
f25da3
                     if (e.exit_code == 1 and
f25da3
diff --git a/cloudinit/util.py b/cloudinit/util.py
f25da3
index 343976ad..fe37ae89 100644
f25da3
--- a/cloudinit/util.py
f25da3
+++ b/cloudinit/util.py
f25da3
@@ -1831,6 +1831,20 @@ def chmod(path, mode):
f25da3
             os.chmod(path, real_mode)
f25da3
 
f25da3
 
f25da3
+def get_group_id(grp_name: str) -> int:
f25da3
+    """
f25da3
+    Returns the group id of a group name, or -1 if no group exists
f25da3
+
f25da3
+    @param grp_name: the name of the group
f25da3
+    """
f25da3
+    gid = -1
f25da3
+    try:
f25da3
+        gid = grp.getgrnam(grp_name).gr_gid
f25da3
+    except KeyError:
f25da3
+        LOG.debug("Group %s is not a valid group name", grp_name)
f25da3
+    return gid
f25da3
+
f25da3
+
f25da3
 def get_permissions(path: str) -> int:
f25da3
     """
f25da3
     Returns the octal permissions of the file/folder pointed by the path,
f25da3
-- 
f25da3
2.27.0
f25da3