Bug 2107113: Fix .ssh directory not owned by core when created by Machine Config D… #3250
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
openshift-ci
bot
added
bugzilla/severity-low
|
@palonsoro: This pull request references Bugzilla bug 2107113, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/bugzilla refresh |
openshift-ci
bot
added
bugzilla/valid-bug
|
@palonsoro: This pull request references Bugzilla bug 2107113, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/assign @sinnykumari |
openshift-ci
bot
added
the
approved
pkg/daemon/update.go
Outdated
| if _, err := os.Stat(coreUserSSHPath); os.IsNotExist(err) { | ||
| os.MkdirAll(coreUserSSHPath, os.FileMode(0o700)) | ||
| os.Chown(coreUserSSHPath, uid, gid) | ||
| } |
There was a problem hiding this comment.
This introduces a race condition - if we're interrupted between creating the directory and calling chown(), the directory will remain owned by root forever.
More generally, privileged code operating on directories owned by unprivileged users is full of huge traps. For example, assuming the core user has sudo permissions removed, this might be subject to symlink attacks.
Both of these issues can be fixed by switching to the core user temporarily. While it's possible to use low-level kernel APIs for this, in this case I'd say it's a lot simpler to fork off this as a subprocess: runuser -u core -- mkdir -m 0700 -p ~/.ssh.
There was a problem hiding this comment.
Really this applies anywhere in the MCO we want to write files that are in directories owned by lesser privileged users - but the core user ssh keys are probably the only case.
There was a problem hiding this comment.
I have changed the code with runuser. Now testing...
There was a problem hiding this comment.
Tested. It worked on my test scenario. Code now just calls runuser -u core -- mkdir -m 0070 -p /home/core/.ssh
palonsoro
force-pushed
the
fix-dotssh-dir
branch
from
ca3ae7e
to
71e88ad
Compare
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
|
Tested. It worked |
|
/unhold |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/retest-required |
|
/retest |
|
it took a while to get back to this PR. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: palonsoro, sinnykumari, yuqi-zhang The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest-required |
|
@palonsoro: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@palonsoro: All pull requests linked via external trackers have merged: Bugzilla bug 2107113 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherry-pick release-4.11 |
|
@palonsoro: new pull request created: #3307 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Fixes BZ#2107113:
~core/.sshdirectory in advance if it didn't previously exist and chown it tocoreuser~core/.sshuser was owned byroot, with this fix, it is owned bycoreuser as expected