diff options
| author |   Zac Medico <zmedico@gentoo.org> | 2020-03-14 17:01:25 -0700 |
|---|---|---|
| committer | Zac Medico <zmedico@gentoo.org> | 2020-03-14 17:42:43 -0700 |
| commit | ef8c21e59953aa5fdd153f19b7bf04356e2164fe (patch) | |
| tree | c28241151fee5b48da777e778222d89305f1dc89 | |
| parent | compression_probe: omit zstd --long=31 on 32-bit arch (bug 710444) (diff) | |
| download | portage-ef8c21e59953aa5fdd153f19b7bf04356e2164fe.tar.gz portage-ef8c21e59953aa5fdd153f19b7bf04356e2164fe.tar.bz2 portage-ef8c21e59953aa5fdd153f19b7bf04356e2164fe.zip | |
_prepare_workdir: apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR (bug 692492)
Apply secure PORTAGE_WORKDIR_MODE permissions to PORTAGE_BUILDDIR,
since the child directory ${D} and its children may have vulnerable
permissions as reported in bug 692492.
Bug: https://bugs.gentoo.org/692492
Signed-off-by: Zac Medico <zmedico@gentoo.org>
| -rw-r--r-- | lib/portage/package/ebuild/prepare_build_dirs.py | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/lib/portage/package/ebuild/prepare_build_dirs.py b/lib/portage/package/ebuild/prepare_build_dirs.py index c325819d1..8349d306f 100644 --- a/lib/portage/package/ebuild/prepare_build_dirs.py +++ b/lib/portage/package/ebuild/prepare_build_dirs.py @@ -1,4 +1,4 @@ -# Copyright 2010-2018 Gentoo Foundation +# Copyright 2010-2020 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 from __future__ import unicode_literals @@ -84,7 +84,7 @@ def prepare_build_dirs(myroot=None, settings=None, cleanup=False): except PortageException: if not os.path.isdir(mydir): raise - for dir_key in ("PORTAGE_BUILDDIR", "HOME", "PKG_LOGDIR", "T"): + for dir_key in ("HOME", "PKG_LOGDIR", "T"): ensure_dirs(mysettings[dir_key], mode=0o755) apply_secpass_permissions(mysettings[dir_key], uid=portage_uid, gid=portage_gid) @@ -272,11 +272,18 @@ def _prepare_workdir(mysettings): writemsg(_("!!! Unable to parse PORTAGE_WORKDIR_MODE='%s', using %s.\n") % \ (mysettings["PORTAGE_WORKDIR_MODE"], oct(workdir_mode))) mysettings["PORTAGE_WORKDIR_MODE"] = oct(workdir_mode).replace('o', '') - try: - apply_secpass_permissions(mysettings["WORKDIR"], - uid=portage_uid, gid=portage_gid, mode=workdir_mode) - except FileNotFound: - pass # ebuild.sh will create it + + permissions = {'mode': workdir_mode} + if portage.data.secpass >= 2: + permissions['uid'] = portage_uid + if portage.data.secpass >= 1: + permissions['gid'] = portage_gid + + # Apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR, since the child + # directory ${D} and its children may have vulnerable permissions + # as reported in bug 692492. + ensure_dirs(mysettings["PORTAGE_BUILDDIR"], **permissions) + ensure_dirs(mysettings["WORKDIR"], **permissions) if mysettings.get("PORTAGE_LOGDIR", "") == "": while "PORTAGE_LOGDIR" in mysettings: |