forked from coreos/rpm-ostree
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rpm-ostree-fix-shadow-mode: Also fix previous deployments
The fix in coreos#4911 for CVE-2024-2905 only fixes the permissions for the current deployment and not for previous deployments for existing installations. The affected files can still be read from the previous deployment by looking at them in `/sysroot/ostree/deploy/...`. Extend the unit to fix all deployments on the system and update the logic to only update files that exists. See: coreos#4911 See: GHSA-2m76-cwhg-7wv6 See: ostreedev/ostree#3211
- Loading branch information
Showing
1 changed file
with
8 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,17 +3,21 @@ | |
# This makes sure to fix permissions on systems that were deployed with the wrong permissions. | ||
Description=Update permissions for /etc/shadow | ||
Documentation=https://github.com/coreos/rpm-ostree-ghsa-2m76-cwhg-7wv6 | ||
ConditionPathExists=!/etc/.rpm-ostree-shadow-mode-fixed.stamp | ||
ConditionPathExists=!/etc/.rpm-ostree-shadow-mode-fixed2.stamp | ||
ConditionPathExists=/run/ostree-booted | ||
# Make sure this is started before any unprivileged (interactive) user has access to the system. | ||
Before=systemd-user-sessions.service | ||
|
||
[Service] | ||
Type=oneshot | ||
ExecStart=chmod --verbose 0000 /etc/shadow /etc/gshadow | ||
ExecStart=-chmod --verbose 0000 /etc/shadow- /etc/gshadow- | ||
ExecStart=touch /etc/.rpm-ostree-shadow-mode-fixed.stamp | ||
ExecStart=bash -c "find /etc -regex '/etc/g?shadow-?' -exec chmod 0000 {} \;" | ||
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
cgwalters
|
||
ExecStart=mount -o remount,rw /sysroot | ||
ExecStart=bash -c "find /sysroot/ostree/deploy/*/deploy/*/etc/ -regex '.*/g?shadow-?' -exec chmod 0000 {} \;" | ||
ExecStart=touch /etc/.rpm-ostree-shadow-mode-fixed2.stamp | ||
RemainAfterExit=yes | ||
|
||
# The MountFlags=slave is so we remount /sysroot temporarily writable | ||
MountFlags=slave | ||
|
||
[Install] | ||
WantedBy=multi-user.target |
I think this is the point where we should move the logic into Rust.
ExecStart=rpm-ostree internals fix-shadow