forked from coreos/rpm-ostree
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rpm-ostree-fix-shadow-mode: Also fix previous deployments
The fix in coreos#4911 for CVE-2024-2905 only fixes the permissions for the current deployment and not for previous deployments for existing installations. The affected files can still be read from the previous deployment by looking at them in `/sysroot/ostree/deploy/...`. Extend the logic to fix all deployments on the system and update the logic to only update files that exists. See: coreos#4911 See: GHSA-2m76-cwhg-7wv6 See: ostreedev/ostree#3211
- Loading branch information
Showing
3 changed files
with
48 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,43 @@ | ||
//! Internal commands for one off fixes. | ||
|
||
// SPDX-License-Identifier: Apache-2.0 OR MIT | ||
|
||
use anyhow::{bail, Context, Result}; | ||
use std::path; | ||
|
||
use crate::core::OSTREE_BOOTED; | ||
|
||
/// Stamp file used to avoid repeating this on every boot | ||
const STAMP_FILE: &str = "/etc/.rpm-ostree-shadow-mode-fixed2.stamp"; | ||
|
||
/// Main entrypoint for the hidden "internals" sub command. | ||
/// Supported sub-commands: | ||
/// - fix-shadow: Fix mode on /etc/[g]shadow[-] files in all deployments (CVE-2024-2905) | ||
pub fn entrypoint(_args: &[&str]) -> Result<()> { | ||
// Skip if we are not run on an ostree booted system | ||
if !path::Path::new(OSTREE_BOOTED).exists() { | ||
bail!("Not running on an ostree based system"); | ||
} | ||
|
||
// Skip if we are not running as root | ||
if rustix::process::geteuid().as_raw() != 0 { | ||
bail!("Must run as root"); | ||
} | ||
|
||
// Iterate over all deployments and fix mode on /etc/[g]shadow[-] | ||
|
||
// Touch stamp file | ||
// touch /etc/.rpm-ostree-shadow-mode-fixed2.stamp | ||
let statedir = Dir::open_ambient_dir(STATE_DIR, cap_std::ambient_authority())?; | ||
statedir.atomic_replace_with(COUNTME_COOKIE, |w| -> Result<_> { | ||
Ok(serde_json::to_writer(w, &cookie)?) | ||
}); | ||
|
||
println!("Successful requests: {}/{}", successful, repos.len()); | ||
if let Err(e) = cookie.persist() { | ||
// Do not exit with a non zero code here as we have still made at least | ||
// one successful request thus we have been counted. | ||
eprintln!("Failed to persist cookie: {}", e); | ||
} | ||
Ok(()) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters