diff --git a/SOURCES/00369-rollover-only-regular-files-in-logging-handlers.patch b/SOURCES/00369-rollover-only-regular-files-in-logging-handlers.patch new file mode 100644 index 0000000..68c818b --- /dev/null +++ b/SOURCES/00369-rollover-only-regular-files-in-logging-handlers.patch @@ -0,0 +1,74 @@ +diff --git a/Lib/logging/handlers.py b/Lib/logging/handlers.py +index 11ebcf1..ee3d960 100644 +--- a/Lib/logging/handlers.py ++++ b/Lib/logging/handlers.py +@@ -181,14 +181,17 @@ class RotatingFileHandler(BaseRotatingHandler): + Basically, see if the supplied record would cause the file to exceed + the size limit we have. + """ ++ # See bpo-45401: Never rollover anything other than regular files ++ if os.path.exists(self.baseFilename) and not os.path.isfile(self.baseFilename): ++ return False + if self.stream is None: # delay was set... + self.stream = self._open() + if self.maxBytes > 0: # are we rolling over? + msg = "%s\n" % self.format(record) + self.stream.seek(0, 2) #due to non-posix-compliant Windows feature + if self.stream.tell() + len(msg) >= self.maxBytes: +- return 1 +- return 0 ++ return True ++ return False + + class TimedRotatingFileHandler(BaseRotatingHandler): + """ +@@ -335,10 +338,13 @@ class TimedRotatingFileHandler(BaseRotatingHandler): + record is not used, as we are just comparing times, but it is needed so + the method signatures are the same + """ ++ # See bpo-45401: Never rollover anything other than regular files ++ if os.path.exists(self.baseFilename) and not os.path.isfile(self.baseFilename): ++ return False + t = int(time.time()) + if t >= self.rolloverAt: +- return 1 +- return 0 ++ return True ++ return False + + def getFilesToDelete(self): + """ +diff --git a/Lib/test/test_logging.py b/Lib/test/test_logging.py +index 45b72e3..055b8e3 100644 +--- a/Lib/test/test_logging.py ++++ b/Lib/test/test_logging.py +@@ -4219,6 +4219,13 @@ class RotatingFileHandlerTest(BaseFileTest): + rh = logging.handlers.RotatingFileHandler(self.fn, maxBytes=0) + self.assertFalse(rh.shouldRollover(None)) + rh.close() ++ # bpo-45401 - test with special file ++ # We set maxBytes to 1 so that rollover would normally happen, except ++ # for the check for regular files ++ rh = logging.handlers.RotatingFileHandler( ++ os.devnull, encoding="utf-8", maxBytes=1) ++ self.assertFalse(rh.shouldRollover(self.next_rec())) ++ rh.close() + + def test_should_rollover(self): + rh = logging.handlers.RotatingFileHandler(self.fn, maxBytes=1) +@@ -4294,6 +4301,15 @@ class RotatingFileHandlerTest(BaseFileTest): + rh.close() + + class TimedRotatingFileHandlerTest(BaseFileTest): ++ def test_should_not_rollover(self): ++ # See bpo-45401. Should only ever rollover regular files ++ fh = logging.handlers.TimedRotatingFileHandler( ++ os.devnull, 'S', encoding="utf-8", backupCount=1) ++ time.sleep(1.1) # a little over a second ... ++ r = logging.makeLogRecord({'msg': 'testing - device file'}) ++ self.assertFalse(fh.shouldRollover(r)) ++ fh.close() ++ + # other test methods added below + def test_rollover(self): + fh = logging.handlers.TimedRotatingFileHandler(self.fn, 'S', diff --git a/SPECS/python3.spec b/SPECS/python3.spec index 5775d8a..e04db64 100644 --- a/SPECS/python3.spec +++ b/SPECS/python3.spec @@ -14,7 +14,7 @@ URL: https://www.python.org/ # WARNING When rebasing to a new Python version, # remember to update the python3-docs package as well Version: %{pybasever}.8 -Release: 42%{?dist} +Release: 43%{?dist} License: Python @@ -622,6 +622,12 @@ Patch366: 00366-CVE-2021-3733.patch # Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Patch368: 00368-CVE-2021-3737.patch +# 00369 # +# Change shouldRollover() methods of logging.handlers to only rollover regular files and not devices +# Upstream: https://bugs.python.org/issue45401 +# Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2009200 +Patch369: 00369-rollover-only-regular-files-in-logging-handlers.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -957,6 +963,7 @@ git apply %{PATCH351} %patch364 -p1 %patch366 -p1 %patch368 -p1 +%patch369 -p1 # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) @@ -1882,6 +1889,10 @@ fi # ====================================================== %changelog +* Mon Oct 11 2021 Charalampos Stratakis - 3.6.8-43 +- Change shouldRollover() methods of logging.handlers to only rollover regular files +Resolves: rhbz#2009200 + * Fri Sep 17 2021 Lumír Balhar - 3.6.8-42 - Security fix for CVE-2021-3737 Resolves: rhbz#1995162