mirror/munki
1
0
Fork 0
mirror of https://github.com/munki/munki.git synced 2026-04-24 05:49:42 -05:00
Code Issues Packages Projects Releases Wiki Activity

verifyFileOnlyWritableByMunkiAndRoot()

Browse Source 
For gid verification, instead of only checking file gid to match current user oir hardcoded 80, check current user's gid, admin's gid, and wheel's gid all dynamically looked up.


git-svn-id: http://munki.googlecode.com/svn/trunk@862 a4e17f2e-e282-11dd-95e1-755cbddbdd66
This commit is contained in:
Justin McWilliams
2010-10-26 13:24:06 +00:00
parent 9a566d108e
commit aacad21154
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code/client/managedsoftwareupdate
+8 -4
View File
@@ -18,11 +18,12 @@
managedsoftwareupdate
"""
import sys
import os
import grp
import optparse
import os
import stat
import subprocess
import sys
import time
import traceback
@@ -117,13 +118,16 @@ def verifyFileOnlyWritableByMunkiAndRoot(file_path):
'%s does not exist. \n %s' % (file_path, str(e)))
try:
admin_gid = grp.getgrnam('admin').gr_gid
wheel_gid = grp.getgrnam('wheel').gr_gid
user_gid = os.getegid()
# verify the munki process uid matches the file owner uid.
if os.geteuid() != file_stat.st_uid:
raise InsecureFilePermissionsError(
'owner does not match munki process!')
# verify the munki process gid matches the file owner gid, or the file
# owner gid is 80 (which is the admin group root is a member of).
elif os.getegid() != file_stat.st_gid and file_stat.st_gid != 80:
# owner gid is wheel or admin gid.
elif file_stat.st_gid not in [admin_gid, wheel_gid, user_gid]:
raise InsecureFilePermissionsError(
'group does not match munki process!')
# verify other users cannot write to the file.