|
 |
35e59b |
From 7da63502137eb8c111b8ae5b5426aec8f7ebdf6b Mon Sep 17 00:00:00 2001
|
|
|
35e59b |
From: "Endi S. Dewata" <edewata@redhat.com>
|
|
|
35e59b |
Date: Mon, 17 May 2021 15:39:44 -0500
|
|
|
35e59b |
Subject: [PATCH] Fix permission for new installation logs
|
|
|
35e59b |
|
|
|
35e59b |
The enable_pki_logger() has been updated to disable
|
|
|
35e59b |
world access for new installation logs to be created
|
|
|
35e59b |
in /var/log/pki.
|
|
|
35e59b |
|
|
|
35e59b |
Resolves: CVE-2021-3551
|
|
|
35e59b |
---
|
|
|
35e59b |
.../python/pki/server/deployment/pkilogging.py | 12 ++++++++++--
|
|
|
35e59b |
1 file changed, 10 insertions(+), 2 deletions(-)
|
|
|
35e59b |
|
|
|
35e59b |
diff --git a/base/server/python/pki/server/deployment/pkilogging.py b/base/server/python/pki/server/deployment/pkilogging.py
|
|
|
35e59b |
index 089a292559..0926173700 100644
|
|
|
35e59b |
--- a/base/server/python/pki/server/deployment/pkilogging.py
|
|
|
35e59b |
+++ b/base/server/python/pki/server/deployment/pkilogging.py
|
|
|
35e59b |
@@ -21,8 +21,12 @@
|
|
|
35e59b |
# System Imports
|
|
|
35e59b |
from __future__ import absolute_import
|
|
|
35e59b |
import logging
|
|
|
35e59b |
+import os
|
|
|
35e59b |
+import pathlib
|
|
|
35e59b |
import pprint
|
|
|
35e59b |
|
|
|
35e59b |
+import pki
|
|
|
35e59b |
+
|
|
|
35e59b |
sensitive_parameters = []
|
|
|
35e59b |
|
|
|
35e59b |
# Initialize 'pretty print' for objects
|
|
|
35e59b |
@@ -51,8 +55,12 @@ def enable_pki_logger(filename, name):
|
|
|
35e59b |
console_format = logging.Formatter('%(levelname)s: %(message)s')
|
|
|
35e59b |
console.setFormatter(console_format)
|
|
|
35e59b |
|
|
|
35e59b |
- # Configure file handler
|
|
|
35e59b |
- log_file = logging.FileHandler(filename, 'w')
|
|
|
35e59b |
+ # Create an empty file with the proper permission
|
|
|
35e59b |
+ pathlib.Path(filename).touch()
|
|
|
35e59b |
+ os.chmod(filename, pki.server.DEFAULT_FILE_MODE)
|
|
|
35e59b |
+
|
|
|
35e59b |
+ # Configure file handler with append mode to preserve the permission
|
|
|
35e59b |
+ log_file = logging.FileHandler(filename)
|
|
|
35e59b |
file_format = logging.Formatter('%(asctime)s %(levelname)s: %(message)s',
|
|
|
35e59b |
'%Y-%m-%d %H:%M:%S')
|
|
|
35e59b |
log_file.setFormatter(file_format)
|
|
|
35e59b |
--
|
|
|
35e59b |
2.30.2
|
|
|
35e59b |
|