|
 |
8639df |
From 3b311a1b069cec59f3d47242282f5d9c67a82e06 Mon Sep 17 00:00:00 2001
|
|
|
8639df |
From: Oyvind Albrigtsen <oalbrigt@redhat.com>
|
|
|
8639df |
Date: Mon, 21 Nov 2022 12:33:22 +0100
|
|
|
8639df |
Subject: [PATCH] fence_virtd: make fence_virtd.conf file mode 600 and fail if
|
|
|
8639df |
fence_virtd.conf or key file are not mode 600
|
|
|
8639df |
|
|
|
8639df |
---
|
|
|
8639df |
agents/virt/config/Makefile.am | 3 +++
|
|
|
8639df |
agents/virt/include/simpleconfig.h | 2 ++
|
|
|
8639df |
agents/virt/server/config.c | 26 ++++++++++++++++++++++++++
|
|
|
8639df |
agents/virt/server/main.c | 16 ++++++++++++++++
|
|
|
8639df |
4 files changed, 47 insertions(+)
|
|
|
8639df |
|
|
|
8639df |
diff --git a/agents/virt/config/Makefile.am b/agents/virt/config/Makefile.am
|
|
|
8639df |
index 86d8df415..19d974278 100644
|
|
|
8639df |
--- a/agents/virt/config/Makefile.am
|
|
|
8639df |
+++ b/agents/virt/config/Makefile.am
|
|
|
8639df |
@@ -37,5 +37,8 @@ y.tab.c: config.y
|
|
|
8639df |
config.c: y.tab.c config.l
|
|
|
8639df |
$(LEX) -oconfig.c $(srcdir)/config.l
|
|
|
8639df |
|
|
|
8639df |
+install-exec-hook:
|
|
|
8639df |
+ chmod 600 $(DESTDIR)$(sysconfdir)/fence_virt.conf
|
|
|
8639df |
+
|
|
|
8639df |
clean-local:
|
|
|
8639df |
rm -f config.tab.c config.tab.h config.c y.tab.c y.tab.h
|
|
|
8639df |
diff --git a/agents/virt/include/simpleconfig.h b/agents/virt/include/simpleconfig.h
|
|
|
8639df |
index 83d54377a..6aba85f02 100644
|
|
|
8639df |
--- a/agents/virt/include/simpleconfig.h
|
|
|
8639df |
+++ b/agents/virt/include/simpleconfig.h
|
|
|
8639df |
@@ -49,6 +49,8 @@ config_object_t *sc_init(void);
|
|
|
8639df |
/* Frees a previously-allocated copy of our simple config object */
|
|
|
8639df |
void sc_release(config_object_t *c);
|
|
|
8639df |
|
|
|
8639df |
+int check_file_permissions(const char *fname);
|
|
|
8639df |
+
|
|
|
8639df |
int do_configure(config_object_t *config, const char *filename);
|
|
|
8639df |
|
|
|
8639df |
#endif
|
|
|
8639df |
diff -uNr a/agents/virt/server/config.c b/agents/virt/server/config.c
|
|
|
8639df |
--- a/agents/virt/server/config.c 2021-07-08 13:09:05.000000000 +0200
|
|
|
8639df |
+++ b/agents/virt/server/config.c 2022-11-22 10:59:09.547919852 +0100
|
|
|
8639df |
@@ -11,6 +11,7 @@
|
|
|
8639df |
#include <fcntl.h>
|
|
|
8639df |
#include <net/if.h>
|
|
|
8639df |
#include <arpa/inet.h>
|
|
|
8639df |
+#include <errno.h>
|
|
|
8639df |
|
|
|
8639df |
#include "simpleconfig.h"
|
|
|
8639df |
#include "static_map.h"
|
|
|
8639df |
@@ -595,6 +596,31 @@ listener_configure(config_object_t *config)
|
|
|
8639df |
}
|
|
|
8639df |
|
|
|
8639df |
|
|
|
8639df |
+int
|
|
|
8639df |
+check_file_permissions(const char *fname)
|
|
|
8639df |
+{
|
|
|
8639df |
+ struct stat st;
|
|
|
8639df |
+ mode_t file_perms = 0600;
|
|
|
8639df |
+ int ret;
|
|
|
8639df |
+
|
|
|
8639df |
+ ret = stat(fname, &st);
|
|
|
8639df |
+ if (ret != 0) {
|
|
|
8639df |
+ printf("stat failed on file '%s': %s\n",
|
|
|
8639df |
+ fname, strerror(errno));
|
|
|
8639df |
+ return 1;
|
|
|
8639df |
+ }
|
|
|
8639df |
+
|
|
|
8639df |
+ if ((st.st_mode & 0777) != file_perms) {
|
|
|
8639df |
+ printf("WARNING: invalid permissions on file "
|
|
|
8639df |
+ "'%s': has 0%o should be 0%o\n", fname,
|
|
|
8639df |
+ (unsigned int)(st.st_mode & 0777),
|
|
|
8639df |
+ (unsigned int)file_perms);
|
|
|
8639df |
+ return 1;
|
|
|
8639df |
+ }
|
|
|
8639df |
+
|
|
|
8639df |
+ return 0;
|
|
|
8639df |
+}
|
|
|
8639df |
+
|
|
|
8639df |
int
|
|
|
8639df |
do_configure(config_object_t *config, const char *config_file)
|
|
|
8639df |
{
|
|
|
8639df |
diff -uNr a/agents/virt/server/main.c b/agents/virt/server/main.c
|
|
|
8639df |
--- a/agents/virt/server/main.c 2021-07-08 13:09:05.000000000 +0200
|
|
|
8639df |
+++ b/agents/virt/server/main.c 2022-11-22 10:58:05.894530187 +0100
|
|
|
8639df |
@@ -14,7 +14,9 @@
|
|
|
8639df |
/* Local includes */
|
|
|
8639df |
#include "simpleconfig.h"
|
|
|
8639df |
#include "static_map.h"
|
|
|
8639df |
+#include "xvm.h"
|
|
|
8639df |
#include "server_plugin.h"
|
|
|
8639df |
+#include "simple_auth.h"
|
|
|
8639df |
#include "debug.h"
|
|
|
8639df |
|
|
|
8639df |
/* configure.c */
|
|
|
8639df |
@@ -203,6 +205,18 @@
|
|
|
8639df |
snprintf(pid_file, PATH_MAX, "/var/run/%s.pid", basename(argv[0]));
|
|
|
8639df |
}
|
|
|
8639df |
|
|
|
8639df |
+ check_file_permissions(config_file);
|
|
|
8639df |
+
|
|
|
8639df |
+ sprintf(val, "listeners/%s/@key_file", listener_name);
|
|
|
8639df |
+ if (sc_get(config, val,
|
|
|
8639df |
+ val, sizeof(val)-1) == 0) {
|
|
|
8639df |
+ dbg_printf(1, "Got %s for key_file\n", val);
|
|
|
8639df |
+ } else {
|
|
|
8639df |
+ snprintf(val, sizeof(val), "%s", DEFAULT_KEY_FILE);
|
|
|
8639df |
+ }
|
|
|
8639df |
+
|
|
|
8639df |
+ check_file_permissions(val);
|
|
|
8639df |
+
|
|
|
8639df |
openlog(basename(argv[0]), LOG_NDELAY | LOG_PID, LOG_DAEMON);
|
|
|
8639df |
|
|
|
8639df |
daemon_init(basename(argv[0]), pid_file, foreground);
|