From 497e39c2cfbee7219a0bb38bd666d61217338f82 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Oct 27 2021 14:39:10 +0000 Subject: import cloud-init-21.1-9.el8 --- diff --git a/SOURCES/ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch b/SOURCES/ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch new file mode 100644 index 0000000..44ad400 --- /dev/null +++ b/SOURCES/ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch @@ -0,0 +1,97 @@ +From 478709d7c157a085e3b2fee432e24978a3485234 Mon Sep 17 00:00:00 2001 +From: Emanuele Giuseppe Esposito +Date: Wed, 20 Oct 2021 16:28:42 +0200 +Subject: [PATCH] cc_ssh.py: fix private key group owner and permissions + (#1070) + +RH-Author: Emanuele Giuseppe Esposito +RH-MergeRequest: 32: cc_ssh.py: fix private key group owner and permissions (#1070) +RH-Commit: [1/1] 0382c3f671ae0fa9cab23dfad1f636967b012148 +RH-Bugzilla: 2013644 +RH-Acked-by: Vitaly Kuznetsov +RH-Acked-by: Mohamed Gamal Morsy + +commit ee296ced9c0a61b1484d850b807c601bcd670ec1 +Author: Emanuele Giuseppe Esposito +Date: Tue Oct 19 21:32:10 2021 +0200 + + cc_ssh.py: fix private key group owner and permissions (#1070) + + When default host keys are created by sshd-keygen (/etc/ssh/ssh_host_*_key) + in RHEL/CentOS/Fedora, openssh it performs the following: + + # create new keys + if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then + exit 1 + fi + + # sanitize permissions + /usr/bin/chgrp ssh_keys $KEY + /usr/bin/chmod 640 $KEY + /usr/bin/chmod 644 $KEY.pub + Note that the group ssh_keys exists only in RHEL/CentOS/Fedora. + + Now that we disable sshd-keygen to allow only cloud-init to create + them, we miss the "sanitize permissions" part, where we set the group + owner as ssh_keys and the private key mode to 640. + + According to https://bugzilla.redhat.com/show_bug.cgi?id=2013644#c8, failing + to set group ownership and permissions like openssh does makes the RHEL openscap + tool generate an error. + + Signed-off-by: Emanuele Giuseppe Esposito eesposit@redhat.com + + RHBZ: 2013644 + +Signed-off-by: Emanuele Giuseppe Esposito +--- + cloudinit/config/cc_ssh.py | 7 +++++++ + cloudinit/util.py | 14 ++++++++++++++ + 2 files changed, 21 insertions(+) + +diff --git a/cloudinit/config/cc_ssh.py b/cloudinit/config/cc_ssh.py +index 05a16dbc..4e986c55 100755 +--- a/cloudinit/config/cc_ssh.py ++++ b/cloudinit/config/cc_ssh.py +@@ -240,6 +240,13 @@ def handle(_name, cfg, cloud, log, _args): + try: + out, err = subp.subp(cmd, capture=True, env=lang_c) + sys.stdout.write(util.decode_binary(out)) ++ ++ gid = util.get_group_id("ssh_keys") ++ if gid != -1: ++ # perform same "sanitize permissions" as sshd-keygen ++ os.chown(keyfile, -1, gid) ++ os.chmod(keyfile, 0o640) ++ os.chmod(keyfile + ".pub", 0o644) + except subp.ProcessExecutionError as e: + err = util.decode_binary(e.stderr).lower() + if (e.exit_code == 1 and +diff --git a/cloudinit/util.py b/cloudinit/util.py +index 343976ad..fe37ae89 100644 +--- a/cloudinit/util.py ++++ b/cloudinit/util.py +@@ -1831,6 +1831,20 @@ def chmod(path, mode): + os.chmod(path, real_mode) + + ++def get_group_id(grp_name: str) -> int: ++ """ ++ Returns the group id of a group name, or -1 if no group exists ++ ++ @param grp_name: the name of the group ++ """ ++ gid = -1 ++ try: ++ gid = grp.getgrnam(grp_name).gr_gid ++ except KeyError: ++ LOG.debug("Group %s is not a valid group name", grp_name) ++ return gid ++ ++ + def get_permissions(path: str) -> int: + """ + Returns the octal permissions of the file/folder pointed by the path, +-- +2.27.0 + diff --git a/SPECS/cloud-init.spec b/SPECS/cloud-init.spec index 3d20d50..d625ef7 100644 --- a/SPECS/cloud-init.spec +++ b/SPECS/cloud-init.spec @@ -6,7 +6,7 @@ Name: cloud-init Version: 21.1 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Cloud instance init scripts Group: System Environment/Base @@ -36,6 +36,8 @@ Patch13: ci-Stop-copying-ssh-system-keys-and-check-folder-permis.patch Patch14: ci-Fix-home-permissions-modified-by-ssh-module-SC-338-9.patch # For bz#1862933 - cloud-init fails with ValueError: need more than 1 value to unpack[rhel-8] Patch15: ci-ssh_utils.py-ignore-when-sshd_config-options-are-not.patch +# For bz#2013644 - cloud-init fails to set host key permissions correctly +Patch16: ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch BuildArch: noarch @@ -227,6 +229,11 @@ fi %config(noreplace) %{_sysconfdir}/rsyslog.d/21-cloudinit.conf %changelog +* Mon Oct 25 2021 Jon Maloy - 21.1-9 +- ci-cc_ssh.py-fix-private-key-group-owner-and-permission.patch [bz#2013644] +- Resolves: bz#2013644 + (cloud-init fails to set host key permissions correctly) + * Thu Sep 23 2021 Miroslav Rezanina - 21.1-8 - ci-ssh_utils.py-ignore-when-sshd_config-options-are-not.patch [bz#1862933] - Resolves: bz#1862933