wbrawner/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixes remote code execution for su/sudo and strict remote umasks

Browse source 
* temporarily changes umask for creating temporary directories
    * otherwise parent directories may not get chmod'ed and end up
      unreadable
refs #9902
This commit is contained in:
Lukas Pirl 2015-07-28 19:24:23 +12:00
parent e505a1b7c4
commit d9aa14feea
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/ansible/plugins/action/__init__.py
View file

@ -144,7 +144,7 @@ class ActionBase:
tmp_mode = None tmp_mode = None
if self._play_context.remote_user != 'root' or self._play_context.become and self._play_context.become_user != 'root': if self._play_context.remote_user != 'root' or self._play_context.become and self._play_context.become_user != 'root':
tmp_mode = 'a+rx' tmp_mode = 0755
cmd = self._connection._shell.mkdtemp(basefile, use_system_tmp, tmp_mode) cmd = self._connection._shell.mkdtemp(basefile, use_system_tmp, tmp_mode)
self._display.debug("executing _low_level_execute_command to create the tmp path") self._display.debug("executing _low_level_execute_command to create the tmp path")

9
lib/ansible/plugins/shell/sh.py
View file

@ -65,9 +65,14 @@ class ShellModule(object):
if system and (basetmp.startswith('$HOME') or basetmp.startswith('~/')): if system and (basetmp.startswith('$HOME') or basetmp.startswith('~/')):
basetmp = self.join_path('/tmp', basefile) basetmp = self.join_path('/tmp', basefile)
cmd = 'mkdir -p "%s"' % basetmp cmd = 'mkdir -p "%s"' % basetmp
if mode:
cmd += ' && chmod %s "%s"' % (mode, basetmp)
cmd += ' && echo "%s"' % basetmp cmd += ' && echo "%s"' % basetmp
# change the umask in a subshell to achieve the desired mode
# also for directories created with `mkdir -p`
if mode:
tmp_umask = 0777 & ~mode
cmd = '(umask %o && %s)' % (tmp_umask, cmd)
return cmd return cmd
def expand_user(self, user_home_path): def expand_user(self, user_home_path):