import python-rtslib-2.1.74-1.el8
This commit is contained in:
parent
7c08947809
commit
d99868ab33
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/rtslib-fb-2.1.73.tar.gz
|
SOURCES/rtslib-fb-2.1.74.tar.gz
|
||||||
|
@ -1 +1 @@
|
|||||||
e9ed6768e70e1da748972b6e350f620db53a53ec SOURCES/rtslib-fb-2.1.73.tar.gz
|
298ec36a694f6f27b84ea16a627e349f5c0792f4 SOURCES/rtslib-fb-2.1.74.tar.gz
|
||||||
|
@ -1,76 +0,0 @@
|
|||||||
From 75e73778dce1cb7a2816a936240ef75adfbd6ed9 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
|
|
||||||
Date: Thu, 16 Jul 2020 17:21:28 +0530
|
|
||||||
Subject: [PATCH] rtslib: safely call shutil.copy()
|
|
||||||
|
|
||||||
Previously we had to replace shutil.copyfile() with shutil.copy(),
|
|
||||||
because we want to copy the file permissions to the destination file
|
|
||||||
along with the data.
|
|
||||||
|
|
||||||
It appears that shutil.copy() is opening the destination file with
|
|
||||||
wide access (0666) first, and then it starts copying the data and
|
|
||||||
at the end it is copying the permissions from source file to destination.
|
|
||||||
|
|
||||||
If we closely notice there appears a window between destination file
|
|
||||||
is opened vs permissions are set on the destination file, which could
|
|
||||||
allow a user to get the contents of the file when opening it at the
|
|
||||||
right time.
|
|
||||||
|
|
||||||
The behavior is a bit unsteady here, it is noticed that, when
|
|
||||||
saveconfig.json file exists, then on shutil.copy(), destination file is
|
|
||||||
opened and a mask 0600 is applied on the file, in case shutil.copy() had
|
|
||||||
to open a new destination saveconfig.json file, then mask 0644 is applied.
|
|
||||||
|
|
||||||
Thanks and Credits to 'Stefan Cornelius <scorneli@redhat.com>' for
|
|
||||||
reporting this, here is the strace he shared from RHEL-7/python-2.7.5
|
|
||||||
env:
|
|
||||||
|
|
||||||
Case 1: When /etc/target/saveconfig.json doesn't exist:
|
|
||||||
|
|
||||||
open("/etc/target/saveconfig.json.temp", O_RDONLY) = 3
|
|
||||||
open("/etc/target/saveconfig.json", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
|
|
||||||
fstat(3, {st_mode=S_IFREG|0600, st_size=71, ...}) = 0
|
|
||||||
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
|
|
||||||
[...]
|
|
||||||
chmod("/etc/target/saveconfig.json", 0600) = 0}")")}")
|
|
||||||
|
|
||||||
Case 2: When /etc/target/saveconfig.json already exist:
|
|
||||||
|
|
||||||
open("/etc/target/saveconfig.json.temp", O_RDONLY) = 3
|
|
||||||
open("/etc/target/saveconfig.json", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
|
|
||||||
fstat(3, {st_mode=S_IFREG|0600, st_size=71, ...}) = 0
|
|
||||||
fstat(4, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
|
|
||||||
[...]
|
|
||||||
chmod("/etc/target/saveconfig.json", 0600) = 0}")")}")
|
|
||||||
|
|
||||||
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
|
|
||||||
---
|
|
||||||
rtslib/root.py | 5 +++--
|
|
||||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/rtslib/root.py b/rtslib/root.py
|
|
||||||
index 2c5cf43..4ecc03c 100644
|
|
||||||
--- a/rtslib/root.py
|
|
||||||
+++ b/rtslib/root.py
|
|
||||||
@@ -476,8 +476,8 @@ class RTSRoot(CFSNode):
|
|
||||||
# prevent the file from being created if it exists due to a race
|
|
||||||
try:
|
|
||||||
fdesc = os.open(tmp_file, os.O_WRONLY | os.O_CREAT | os.O_EXCL, mode)
|
|
||||||
- finally:
|
|
||||||
- os.umask(umask_original)
|
|
||||||
+ except OSError:
|
|
||||||
+ raise ExecutionError("Could not open %s" % tmp_file)
|
|
||||||
|
|
||||||
with os.fdopen(fdesc, 'w') as f:
|
|
||||||
f.write(json.dumps(saveconf, sort_keys=True, indent=2))
|
|
||||||
@@ -488,6 +488,7 @@ class RTSRoot(CFSNode):
|
|
||||||
|
|
||||||
# copy along with permissions
|
|
||||||
shutil.copy(tmp_file, save_file)
|
|
||||||
+ os.umask(umask_original)
|
|
||||||
os.remove(tmp_file)
|
|
||||||
|
|
||||||
def restore_from_file(self, restore_file=None, clear_existing=True,
|
|
||||||
--
|
|
||||||
2.26.2
|
|
||||||
|
|
@ -21,14 +21,13 @@ Name: python-rtslib
|
|||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
Summary: API for Linux kernel LIO SCSI target
|
Summary: API for Linux kernel LIO SCSI target
|
||||||
Version: 2.1.73
|
Version: 2.1.74
|
||||||
Release: 2%{?dist}
|
Release: 1%{?dist}
|
||||||
URL: https://github.com/open-iscsi/%{oname}
|
URL: https://github.com/open-iscsi/%{oname}
|
||||||
Source: %{url}/archive/v%{version}/%{oname}-%{version}.tar.gz
|
Source: %{url}/archive/v%{version}/%{oname}-%{version}.tar.gz
|
||||||
Source1: target.service
|
Source1: target.service
|
||||||
Patch0: 0001-Turn-off-unsupported-fabrics.patch
|
Patch0: 0001-Turn-off-unsupported-fabrics.patch
|
||||||
Patch1: 0002-default_dbroot.patch
|
Patch1: 0002-default_dbroot.patch
|
||||||
Patch2: 0003-rtslib-safely-call-shutil.copy.patch
|
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
BuildRequires: systemd-units
|
BuildRequires: systemd-units
|
||||||
Requires(post): systemd
|
Requires(post): systemd
|
||||||
@ -103,7 +102,6 @@ on system restart.
|
|||||||
%setup -q -n %{oname}-%{version}
|
%setup -q -n %{oname}-%{version}
|
||||||
%patch0 -p1
|
%patch0 -p1
|
||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
%patch2 -p1
|
|
||||||
|
|
||||||
%if %{with python3}
|
%if %{with python3}
|
||||||
rm -rf %{py3dir}
|
rm -rf %{py3dir}
|
||||||
@ -193,6 +191,9 @@ install -m 644 doc/saveconfig.json.5.gz %{buildroot}%{_mandir}/man5/
|
|||||||
%endif # with python2
|
%endif # with python2
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Oct 26 2020 Maurizio Lombardi <mlombard@redhat.com> - 2.1.74-1
|
||||||
|
- Update to the latest upstream version
|
||||||
|
|
||||||
* Tue Jul 21 2020 Maurizio Lombardi <mlombard@redhat.com> - 2.1.73-2
|
* Tue Jul 21 2020 Maurizio Lombardi <mlombard@redhat.com> - 2.1.73-2
|
||||||
- Merge a fix to prevent a potential data leak when saving the config file
|
- Merge a fix to prevent a potential data leak when saving the config file
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user