import python-rtslib-2.1.74-1.el8

This commit is contained in:
CentOS Sources 2021-05-18 02:34:42 -04:00 committed by Andrew Lukoshko
parent 7c08947809
commit d99868ab33
4 changed files with 7 additions and 82 deletions

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/rtslib-fb-2.1.73.tar.gz SOURCES/rtslib-fb-2.1.74.tar.gz

View File

@ -1 +1 @@
e9ed6768e70e1da748972b6e350f620db53a53ec SOURCES/rtslib-fb-2.1.73.tar.gz 298ec36a694f6f27b84ea16a627e349f5c0792f4 SOURCES/rtslib-fb-2.1.74.tar.gz

View File

@ -1,76 +0,0 @@
From 75e73778dce1cb7a2816a936240ef75adfbd6ed9 Mon Sep 17 00:00:00 2001
From: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Date: Thu, 16 Jul 2020 17:21:28 +0530
Subject: [PATCH] rtslib: safely call shutil.copy()
Previously we had to replace shutil.copyfile() with shutil.copy(),
because we want to copy the file permissions to the destination file
along with the data.
It appears that shutil.copy() is opening the destination file with
wide access (0666) first, and then it starts copying the data and
at the end it is copying the permissions from source file to destination.
If we closely notice there appears a window between destination file
is opened vs permissions are set on the destination file, which could
allow a user to get the contents of the file when opening it at the
right time.
The behavior is a bit unsteady here, it is noticed that, when
saveconfig.json file exists, then on shutil.copy(), destination file is
opened and a mask 0600 is applied on the file, in case shutil.copy() had
to open a new destination saveconfig.json file, then mask 0644 is applied.
Thanks and Credits to 'Stefan Cornelius <scorneli@redhat.com>' for
reporting this, here is the strace he shared from RHEL-7/python-2.7.5
env:
Case 1: When /etc/target/saveconfig.json doesn't exist:
open("/etc/target/saveconfig.json.temp", O_RDONLY) = 3
open("/etc/target/saveconfig.json", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
fstat(3, {st_mode=S_IFREG|0600, st_size=71, ...}) = 0
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
[...]
chmod("/etc/target/saveconfig.json", 0600) = 0}")")}")
Case 2: When /etc/target/saveconfig.json already exist:
open("/etc/target/saveconfig.json.temp", O_RDONLY) = 3
open("/etc/target/saveconfig.json", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
fstat(3, {st_mode=S_IFREG|0600, st_size=71, ...}) = 0
fstat(4, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
[...]
chmod("/etc/target/saveconfig.json", 0600) = 0}")")}")
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
---
rtslib/root.py | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/rtslib/root.py b/rtslib/root.py
index 2c5cf43..4ecc03c 100644
--- a/rtslib/root.py
+++ b/rtslib/root.py
@@ -476,8 +476,8 @@ class RTSRoot(CFSNode):
# prevent the file from being created if it exists due to a race
try:
fdesc = os.open(tmp_file, os.O_WRONLY | os.O_CREAT | os.O_EXCL, mode)
- finally:
- os.umask(umask_original)
+ except OSError:
+ raise ExecutionError("Could not open %s" % tmp_file)
with os.fdopen(fdesc, 'w') as f:
f.write(json.dumps(saveconf, sort_keys=True, indent=2))
@@ -488,6 +488,7 @@ class RTSRoot(CFSNode):
# copy along with permissions
shutil.copy(tmp_file, save_file)
+ os.umask(umask_original)
os.remove(tmp_file)
def restore_from_file(self, restore_file=None, clear_existing=True,
--
2.26.2

View File

@ -21,14 +21,13 @@ Name: python-rtslib
License: ASL 2.0 License: ASL 2.0
Group: System Environment/Libraries Group: System Environment/Libraries
Summary: API for Linux kernel LIO SCSI target Summary: API for Linux kernel LIO SCSI target
Version: 2.1.73 Version: 2.1.74
Release: 2%{?dist} Release: 1%{?dist}
URL: https://github.com/open-iscsi/%{oname} URL: https://github.com/open-iscsi/%{oname}
Source: %{url}/archive/v%{version}/%{oname}-%{version}.tar.gz Source: %{url}/archive/v%{version}/%{oname}-%{version}.tar.gz
Source1: target.service Source1: target.service
Patch0: 0001-Turn-off-unsupported-fabrics.patch Patch0: 0001-Turn-off-unsupported-fabrics.patch
Patch1: 0002-default_dbroot.patch Patch1: 0002-default_dbroot.patch
Patch2: 0003-rtslib-safely-call-shutil.copy.patch
BuildArch: noarch BuildArch: noarch
BuildRequires: systemd-units BuildRequires: systemd-units
Requires(post): systemd Requires(post): systemd
@ -103,7 +102,6 @@ on system restart.
%setup -q -n %{oname}-%{version} %setup -q -n %{oname}-%{version}
%patch0 -p1 %patch0 -p1
%patch1 -p1 %patch1 -p1
%patch2 -p1
%if %{with python3} %if %{with python3}
rm -rf %{py3dir} rm -rf %{py3dir}
@ -193,6 +191,9 @@ install -m 644 doc/saveconfig.json.5.gz %{buildroot}%{_mandir}/man5/
%endif # with python2 %endif # with python2
%changelog %changelog
* Mon Oct 26 2020 Maurizio Lombardi <mlombard@redhat.com> - 2.1.74-1
- Update to the latest upstream version
* Tue Jul 21 2020 Maurizio Lombardi <mlombard@redhat.com> - 2.1.73-2 * Tue Jul 21 2020 Maurizio Lombardi <mlombard@redhat.com> - 2.1.73-2
- Merge a fix to prevent a potential data leak when saving the config file - Merge a fix to prevent a potential data leak when saving the config file