|
 |
497e39 |
From 478709d7c157a085e3b2fee432e24978a3485234 Mon Sep 17 00:00:00 2001
|
|
|
497e39 |
From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
497e39 |
Date: Wed, 20 Oct 2021 16:28:42 +0200
|
|
|
497e39 |
Subject: [PATCH] cc_ssh.py: fix private key group owner and permissions
|
|
|
497e39 |
(#1070)
|
|
|
497e39 |
|
|
|
497e39 |
RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
497e39 |
RH-MergeRequest: 32: cc_ssh.py: fix private key group owner and permissions (#1070)
|
|
|
497e39 |
RH-Commit: [1/1] 0382c3f671ae0fa9cab23dfad1f636967b012148
|
|
|
497e39 |
RH-Bugzilla: 2013644
|
|
|
497e39 |
RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
497e39 |
RH-Acked-by: Mohamed Gamal Morsy <mmorsy@redhat.com>
|
|
|
497e39 |
|
|
|
497e39 |
commit ee296ced9c0a61b1484d850b807c601bcd670ec1
|
|
|
497e39 |
Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
497e39 |
Date: Tue Oct 19 21:32:10 2021 +0200
|
|
|
497e39 |
|
|
|
497e39 |
cc_ssh.py: fix private key group owner and permissions (#1070)
|
|
|
497e39 |
|
|
|
497e39 |
When default host keys are created by sshd-keygen (/etc/ssh/ssh_host_*_key)
|
|
|
497e39 |
in RHEL/CentOS/Fedora, openssh it performs the following:
|
|
|
497e39 |
|
|
|
497e39 |
# create new keys
|
|
|
497e39 |
if ! $KEYGEN -q -t $KEYTYPE -f $KEY -C '' -N '' >&/dev/null; then
|
|
|
497e39 |
exit 1
|
|
|
497e39 |
fi
|
|
|
497e39 |
|
|
|
497e39 |
# sanitize permissions
|
|
|
497e39 |
/usr/bin/chgrp ssh_keys $KEY
|
|
|
497e39 |
/usr/bin/chmod 640 $KEY
|
|
|
497e39 |
/usr/bin/chmod 644 $KEY.pub
|
|
|
497e39 |
Note that the group ssh_keys exists only in RHEL/CentOS/Fedora.
|
|
|
497e39 |
|
|
|
497e39 |
Now that we disable sshd-keygen to allow only cloud-init to create
|
|
|
497e39 |
them, we miss the "sanitize permissions" part, where we set the group
|
|
|
497e39 |
owner as ssh_keys and the private key mode to 640.
|
|
|
497e39 |
|
|
|
497e39 |
According to https://bugzilla.redhat.com/show_bug.cgi?id=2013644#c8, failing
|
|
|
497e39 |
to set group ownership and permissions like openssh does makes the RHEL openscap
|
|
|
497e39 |
tool generate an error.
|
|
|
497e39 |
|
|
|
497e39 |
Signed-off-by: Emanuele Giuseppe Esposito eesposit@redhat.com
|
|
|
497e39 |
|
|
|
497e39 |
RHBZ: 2013644
|
|
|
497e39 |
|
|
|
497e39 |
Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
|
|
|
497e39 |
---
|
|
|
497e39 |
cloudinit/config/cc_ssh.py | 7 +++++++
|
|
|
497e39 |
cloudinit/util.py | 14 ++++++++++++++
|
|
|
497e39 |
2 files changed, 21 insertions(+)
|
|
|
497e39 |
|
|
|
497e39 |
diff --git a/cloudinit/config/cc_ssh.py b/cloudinit/config/cc_ssh.py
|
|
|
497e39 |
index 05a16dbc..4e986c55 100755
|
|
|
497e39 |
--- a/cloudinit/config/cc_ssh.py
|
|
|
497e39 |
+++ b/cloudinit/config/cc_ssh.py
|
|
|
497e39 |
@@ -240,6 +240,13 @@ def handle(_name, cfg, cloud, log, _args):
|
|
|
497e39 |
try:
|
|
|
497e39 |
out, err = subp.subp(cmd, capture=True, env=lang_c)
|
|
|
497e39 |
sys.stdout.write(util.decode_binary(out))
|
|
|
497e39 |
+
|
|
|
497e39 |
+ gid = util.get_group_id("ssh_keys")
|
|
|
497e39 |
+ if gid != -1:
|
|
|
497e39 |
+ # perform same "sanitize permissions" as sshd-keygen
|
|
|
497e39 |
+ os.chown(keyfile, -1, gid)
|
|
|
497e39 |
+ os.chmod(keyfile, 0o640)
|
|
|
497e39 |
+ os.chmod(keyfile + ".pub", 0o644)
|
|
|
497e39 |
except subp.ProcessExecutionError as e:
|
|
|
497e39 |
err = util.decode_binary(e.stderr).lower()
|
|
|
497e39 |
if (e.exit_code == 1 and
|
|
|
497e39 |
diff --git a/cloudinit/util.py b/cloudinit/util.py
|
|
|
497e39 |
index 343976ad..fe37ae89 100644
|
|
|
497e39 |
--- a/cloudinit/util.py
|
|
|
497e39 |
+++ b/cloudinit/util.py
|
|
|
497e39 |
@@ -1831,6 +1831,20 @@ def chmod(path, mode):
|
|
|
497e39 |
os.chmod(path, real_mode)
|
|
|
497e39 |
|
|
|
497e39 |
|
|
|
497e39 |
+def get_group_id(grp_name: str) -> int:
|
|
|
497e39 |
+ """
|
|
|
497e39 |
+ Returns the group id of a group name, or -1 if no group exists
|
|
|
497e39 |
+
|
|
|
497e39 |
+ @param grp_name: the name of the group
|
|
|
497e39 |
+ """
|
|
|
497e39 |
+ gid = -1
|
|
|
497e39 |
+ try:
|
|
|
497e39 |
+ gid = grp.getgrnam(grp_name).gr_gid
|
|
|
497e39 |
+ except KeyError:
|
|
|
497e39 |
+ LOG.debug("Group %s is not a valid group name", grp_name)
|
|
|
497e39 |
+ return gid
|
|
|
497e39 |
+
|
|
|
497e39 |
+
|
|
|
497e39 |
def get_permissions(path: str) -> int:
|
|
|
497e39 |
"""
|
|
|
497e39 |
Returns the octal permissions of the file/folder pointed by the path,
|
|
|
497e39 |
--
|
|
|
497e39 |
2.27.0
|
|
|
497e39 |
|