1 Star 0 Fork 19

温占礼 / python-rtslib

forked from src-openEuler / python-rtslib 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
0001-saveconfig-copy-temp-configfile-with-permissions.patch 2.36 KB
一键复制 编辑 原始数据 按行查看 历史
wj196 提交于 2020-07-17 15:10 . fix CVE-2020-14019
From b23d061ee0fa7924d2cdce6194c313b9ee06c468 Mon Sep 17 00:00:00 2001
From: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Date: Thu, 28 May 2020 20:42:16 +0530
Subject: [PATCH] saveconfig: copy temp configfile with permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
shutil.copyfile() will not copy permissions, so all the perms that we
set on tempfile will go for a toss, and will be reset to default
┌──────────────────┬────────┬───────────┬───────┬────────────────┐
Function │ Copies │ Copies │Can use│ Destination │
│metadata│permissions│buffer │may be directory│
├──────────────────┼────────┼───────────┼───────┼────────────────┤
│shutil.copy │ No │ Yes │ No │ Yes │
│shutil.copyfile │ No │ No │ No │ No │
│shutil.copy2 │ Yes │ Yes │ No │ Yes │
│shutil.copyfileobj│ No │ No │ Yes │ No │
└──────────────────┴────────┴───────────┴───────┴────────────────┘
Without this fix:
----------------
$ ls /etc/target/saveconfig.json -l
-rw-r--r-- 1 root root 5078 May 28 20:01 /etc/target/saveconfig.json
With this fix:
--------------
$ ls /etc/target/saveconfig.json -l
-rw------- 1 root root 5078 May 28 20:15 /etc/target/saveconfig.json
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
---
rtslib/root.py | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/rtslib/root.py b/rtslib/root.py
index a101edd..7364154 100644
--- a/rtslib/root.py
+++ b/rtslib/root.py
@@ -486,7 +486,8 @@ class RTSRoot(CFSNode):
os.fsync(f.fileno())
f.close()
- shutil.copyfile(tmp_file, save_file)
+ # copy along with permissions
+ shutil.copy(tmp_file, save_file)
os.remove(tmp_file)
def restore_from_file(self, restore_file=None, clear_existing=True,
--
1.8.3.1
1
https://gitee.com/zhanliwen/python-rtslib.git
git@gitee.com:zhanliwen/python-rtslib.git
zhanliwen
python-rtslib
python-rtslib
master

搜索帮助