|
 |
60e4b6 |
From 0641129e214fa1cd2a67740c3193944285781819 Mon Sep 17 00:00:00 2001
|
|
|
60e4b6 |
From: =?UTF-8?q?Miroslav=20Such=C3=BD?= <msuchy@redhat.com>
|
|
|
60e4b6 |
Date: Wed, 6 May 2020 19:10:48 +0200
|
|
|
60e4b6 |
Subject: [PATCH] setgid instead of setuid the
|
|
|
60e4b6 |
abrt-action-install-debuginfo-to-abrt-cache [RHBZ 1796245]
|
|
|
60e4b6 |
|
|
|
60e4b6 |
This is called by abrt-action-install-debuginfo-to-abrt-cache which used to be setuid and now is setgid binary.
|
|
|
60e4b6 |
Therefore we do not need to setuid and we neither need it.
|
|
|
60e4b6 |
|
|
|
60e4b6 |
Resolves:
|
|
|
60e4b6 |
https://bugzilla.redhat.com/show_bug.cgi?id=1796245
|
|
|
60e4b6 |
---
|
|
|
60e4b6 |
src/client-python/reportclient/debuginfo.py | 25 +++++++++------------
|
|
|
60e4b6 |
1 file changed, 11 insertions(+), 14 deletions(-)
|
|
|
60e4b6 |
|
|
|
60e4b6 |
diff --git a/src/client-python/reportclient/debuginfo.py b/src/client-python/reportclient/debuginfo.py
|
|
|
60e4b6 |
index 561de52f..560629cc 100644
|
|
|
60e4b6 |
--- a/src/client-python/reportclient/debuginfo.py
|
|
|
60e4b6 |
+++ b/src/client-python/reportclient/debuginfo.py
|
|
|
60e4b6 |
@@ -35,41 +35,38 @@ from reportclient import (_, log1, log2, RETURN_OK, RETURN_FAILURE,
|
|
|
60e4b6 |
error_msg)
|
|
|
60e4b6 |
|
|
|
60e4b6 |
|
|
|
60e4b6 |
-def ensure_abrt_uid(fn):
|
|
|
60e4b6 |
+def ensure_abrt_gid(fn):
|
|
|
60e4b6 |
"""
|
|
|
60e4b6 |
- Ensures that the function is called using abrt's uid and gid
|
|
|
60e4b6 |
+ Ensures that the function is called using abrt's gid
|
|
|
60e4b6 |
|
|
|
60e4b6 |
Returns:
|
|
|
60e4b6 |
Either an unchanged function object or a wrapper function object for
|
|
|
60e4b6 |
the function.
|
|
|
60e4b6 |
"""
|
|
|
60e4b6 |
|
|
|
60e4b6 |
- current_uid = os.getuid()
|
|
|
60e4b6 |
current_gid = os.getgid()
|
|
|
60e4b6 |
abrt = pwd.getpwnam("abrt")
|
|
|
60e4b6 |
|
|
|
60e4b6 |
# if we're are already running as abrt, don't do anything
|
|
|
60e4b6 |
- if abrt.pw_uid == current_uid and abrt.pw_gid == current_gid:
|
|
|
60e4b6 |
+ if abrt.pw_gid == current_gid:
|
|
|
60e4b6 |
return fn
|
|
|
60e4b6 |
|
|
|
60e4b6 |
def wrapped(*args, **kwargs):
|
|
|
60e4b6 |
"""
|
|
|
60e4b6 |
Wrapper function around the called function.
|
|
|
60e4b6 |
|
|
|
60e4b6 |
- Sets up uid and gid to match abrt's and after the function finishes
|
|
|
60e4b6 |
- rolls its uid and gid back.
|
|
|
60e4b6 |
+ Sets up gid to match abrt's and after the function finishes
|
|
|
60e4b6 |
+ rolls its gid back.
|
|
|
60e4b6 |
|
|
|
60e4b6 |
Returns:
|
|
|
60e4b6 |
Return value of the wrapped function.
|
|
|
60e4b6 |
"""
|
|
|
60e4b6 |
|
|
|
60e4b6 |
- # switch to abrt
|
|
|
60e4b6 |
+ # switch to abrt group
|
|
|
60e4b6 |
os.setegid(abrt.pw_gid)
|
|
|
60e4b6 |
- os.seteuid(abrt.pw_uid)
|
|
|
60e4b6 |
# extract the files as abrt:abrt
|
|
|
60e4b6 |
retval = fn(*args, **kwargs)
|
|
|
60e4b6 |
# switch back to whatever we were
|
|
|
60e4b6 |
- os.seteuid(current_uid)
|
|
|
60e4b6 |
os.setegid(current_gid)
|
|
|
60e4b6 |
return retval
|
|
|
60e4b6 |
|
|
|
60e4b6 |
@@ -79,7 +76,7 @@ def ensure_abrt_uid(fn):
|
|
|
60e4b6 |
# TODO: unpack just required debuginfo and not entire rpm?
|
|
|
60e4b6 |
# ..that can lead to: foo.c No such file and directory
|
|
|
60e4b6 |
# files is not used...
|
|
|
60e4b6 |
-@ensure_abrt_uid
|
|
|
60e4b6 |
+@ensure_abrt_gid
|
|
|
60e4b6 |
def unpack_rpm(package_full_path, files, tmp_dir, destdir, exact_files=False):
|
|
|
60e4b6 |
"""
|
|
|
60e4b6 |
Unpacks a single rpm located in tmp_dir into destdir.
|
|
|
60e4b6 |
@@ -265,7 +262,7 @@ class DebugInfoDownload(object):
|
|
|
60e4b6 |
else:
|
|
|
60e4b6 |
print("ERR: unmute called without mute?")
|
|
|
60e4b6 |
|
|
|
60e4b6 |
- @ensure_abrt_uid
|
|
|
60e4b6 |
+ @ensure_abrt_gid
|
|
|
60e4b6 |
def setup_tmp_dirs(self):
|
|
|
60e4b6 |
if not os.path.exists(self.tmpdir):
|
|
|
60e4b6 |
try:
|
|
|
60e4b6 |
@@ -406,9 +403,9 @@ class DebugInfoDownload(object):
|
|
|
60e4b6 |
|
|
|
60e4b6 |
s = os.stat(self.cachedir)
|
|
|
60e4b6 |
abrt = pwd.getpwnam("abrt")
|
|
|
60e4b6 |
- if (s.st_uid != abrt.pw_uid) or (s.st_gid != abrt.pw_gid):
|
|
|
60e4b6 |
- print(_("'{0}' must be owned by abrt. "
|
|
|
60e4b6 |
- "Please run '# chown -R abrt.abrt {0}' "
|
|
|
60e4b6 |
+ if s.st_gid != abrt.pw_gid:
|
|
|
60e4b6 |
+ print(_("'{0}' must be owned by group abrt. "
|
|
|
60e4b6 |
+ "Please run '# chown -R :abrt {0}' "
|
|
|
60e4b6 |
"to fix the issue.").format(self.cachedir))
|
|
|
60e4b6 |
|
|
|
60e4b6 |
clean_up(self.tmpdir)
|
|
|
60e4b6 |
--
|
|
|
60e4b6 |
2.21.3
|
|
|
60e4b6 |
|