blob: 616143be18c9f3ddd26f30db2242968cd6c81899 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
From 24c25b38ed6fc95ed919ab34463cdb10bdcc57fd Mon Sep 17 00:00:00 2001
From: Dolph Mathews <dolph.mathews@gmail.com>
Date: Wed, 8 May 2013 10:49:20 -0500
Subject: [PATCH] Securely create signing_dir (bug 1174608)
Also verifies the security of an existing signing_dir.
Change-Id: I0685b4274a94ad3974a2b2a7ab3f45830d3934bb
(cherry picked from python-keystoneclient 1736e2ffb12f70eeebed019448bc14def48aa036)
---
keystone/middleware/auth_token.py | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/keystone/middleware/auth_token.py b/keystone/middleware/auth_token.py
index ddadf9f..01e6c58 100644
--- a/keystone/middleware/auth_token.py
+++ b/keystone/middleware/auth_token.py
@@ -219,15 +219,20 @@ class AuthProtocol(object):
self.signing_dirname = '%s/keystone-signing' % os.environ['HOME']
LOG.info('Using %s as cache directory for signing certificate' %
self.signing_dirname)
- if (os.path.exists(self.signing_dirname) and
- not os.access(self.signing_dirname, os.W_OK)):
- raise ConfigurationError("unable to access signing dir %s" %
- self.signing_dirname)
-
- if not os.path.exists(self.signing_dirname):
- os.makedirs(self.signing_dirname)
- #will throw IOError if it cannot change permissions
- os.chmod(self.signing_dirname, stat.S_IRWXU)
+ if os.path.exists(self.signing_dirname):
+ if not os.access(self.signing_dirname, os.W_OK):
+ raise ConfigurationError(
+ 'unable to access signing_dir %s' % self.signing_dirname)
+ if os.stat(self.signing_dirname).st_uid != os.getuid():
+ LOG.warning(
+ 'signing_dir is not owned by %s' % os.getlogin())
+ current_mode = stat.S_IMODE(os.stat(self.signing_dirname).st_mode)
+ if current_mode != stat.S_IRWXU:
+ LOG.warning(
+ 'signing_dir mode is %s instead of %s' %
+ (oct(current_mode), oct(stat.S_IRWXU)))
+ else:
+ os.makedirs(self.signing_dirname, stat.S_IRWXU)
val = '%s/signing_cert.pem' % self.signing_dirname
self.signing_cert_file_name = val
--
1.8.1.5
|
GitWeb
