From 5ca46d69e48211eb829c640b0dd3eda287a9933b Mon Sep 17 00:00:00 2001

From: Milind Changire <mchangir@redhat.com>

Date: Fri, 14 Oct 2016 12:53:27 +0530

Subject: [PATCH 104/141] build: randomize temp file names in pretrans scriptlets

Security issue CVE-2015-1795 mentions about possibility of file name

spoof attack for the %pretrans server scriptlet.

Since %pretrans scriptlets are executed only for server builds, we can

use os.tmpname() to randomize temporary file names for all %pretrans

scriptlets using this mechanism.

Label: DOWNSTREAM ONLY

Change-Id: Ic82433897432794b6d311d836355aa4bad886369

BUG: 1362044

Signed-off-by: Milind Changire <mchangir@redhat.com>

Reviewed-on: https://code.engineering.redhat.com/gerrit/86187

Reviewed-by: Siddharth Sharma <siddharth@redhat.com>

Reviewed-by: Niels de Vos <ndevos@redhat.com>

Reviewed-by: Atin Mukherjee <amukherj@redhat.com>

---

 glusterfs.spec.in |  103 +++++++++++++++++++++++++++++++---------------------

 1 files changed, 61 insertions(+), 42 deletions(-)

diff --git a/glusterfs.spec.in b/glusterfs.spec.in

index 2bcb1ff..9501c05 100644

--- a/glusterfs.spec.in

+++ b/glusterfs.spec.in

@@ -1461,9 +1461,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1502,9 +1503,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-api_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1543,9 +1545,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-api-devel_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1584,9 +1587,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-cli_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1625,9 +1629,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-client-xlators_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1666,9 +1671,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-devel_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1707,9 +1713,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-fuse_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1748,9 +1755,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-ganesha_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1790,9 +1798,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-geo-replication_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1832,9 +1841,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-libs_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1873,9 +1883,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/python-gluster_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1915,9 +1926,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-rdma_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -1958,9 +1970,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-resource-agents_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -2000,9 +2013,10 @@ if [ $? -eq 0 ]; then

 fi

 ]]

--- rpm in RHEL5 does not have os.tmpname()

--- io.tmpfile() can not be resolved to a filename to pass to bash :-/

-tmpname = "/tmp/glusterfs-server_pretrans_" .. os.date("%s")

+-- Since we run pretrans scripts only for RPMs built for a server build,

+-- we can now use os.tmpname() since it is available on RHEL6 and later

+-- platforms which are server platforms.

+tmpname = os.tmpname()

 tmpfile = io.open(tmpname, "w")

 tmpfile:write(script)

 tmpfile:close()

@@ -2014,6 +2028,10 @@ end

 %endif

 %changelog

+* Fri Oct 14 2016 Milind Changire <mchangir@redhat.com>

+- Changed pretrans scripts to use os.tmpname() for enhanced security

+  for server builds only (#1362044)

+

 * Tue Sep 27 2016 Milind Changire <mchangir@redhat.com>

 - Added systemd requirement to glusterfs-server and glusterfs-events packages

@@ -2120,6 +2138,7 @@ end

 * Mon May 18 2015 Milind Changire <mchangir@redhat.com>

 - Move file peer_add_secret_pub to the server RPM to support glusterfind (#1221544)

+

 * Sun May 17 2015 Niels de Vos <ndevos@redhat.com>

 - Fix building on RHEL-5 based distributions (#1222317)

-- 

1.7.1