Bug 1158891

Summary:	Wrong access rights to sos report after rebase to 3.2
Product:	Red Hat Enterprise Linux 7	Reporter:	Miroslav Hradílek <mhradile>
Component:	sos	Assignee:	Bryn M. Reeves <bmr>
Status:	CLOSED ERRATA	QA Contact:	David Kutálek <dkutalek>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.1	CC:	agk, dkutalek
Target Milestone:	rc	Keywords:	EasyFix, Patch, Rebase, Upstream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	sos-3.2-7.el7	Doc Type:	Bug Fix
Doc Text:	Cause: A regression in the handling of the process umask caused sosreport archives to be created with incorrect permissions. Consequence: Unprivileged local users could read the report archive. Fix: The correct umask is now set prior to creating the archive resulting in the intended "rw for owner only" file mode (0600). Result: Only the local root user can access the report content.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-05 11:24:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Miroslav Hradílek 2014-10-30 13:10:10 UTC

Description of problem:
Prior to the rebase to 3.2 the generated sosreports had access rights defined like so
-rw-------. 1 root root

after rebase it is
-rw-r--r--. 1 root root

I think only root should be able to access sosreport.

Version-Release number of selected component (if applicable):
sos-3.2-4.el7.noarch

How reproducible:
100%

Comment 2 Bryn M. Reeves 2014-10-30 15:31:01 UTC

This is a regression due to commit commit 8d25777:

8d2577786cce6fcc915836108e405dbf5025dec8
Author: Bryn M. Reeves <bmr>
Date:   Tue Apr 29 19:02:43 2014 +0100

    Drop cwd/umask shenanigans from TarFileArchive::finalize()
    

Although the cwd manipulations are no longer needed the umask modification is - I run my systems with a umask of 077 for root (which gives the expected behaviour even after the above commit). However as the default root umask for Red Hat distros has always been 022 we fail to drop group and other read privileges for the archive in the default install case.

Reverting the two umask lines from the above patch obviously fixes the problem but don't think this is the best approach for 7.1; one of the motivations for removing this code is that the archive classes in sos explicitly do not handle exceptions (it's handled in the main sosreport class that calls the archive methods).

Fiddling with the umask in the archive complicates this because it's unclear when an exception occurs within Archive.finalize() whether or not the umask needs to be reset or not.

I think it's better to deal with  this by moving the umask manipulation up to SoSReport; that way the umask cleanup happens under a 'finally' block and doesn't need any special treatment to avoid leaking changes to the mask on error.

Comment 3 Bryn M. Reeves 2014-10-30 15:31:25 UTC

--- /root/src/git/sos/sos/sosreport.py  2014-09-19 15:33:07.872321514 +0100
+++ /usr/lib/python2.7/site-packages/sos/sosreport.py   2014-10-30 17:03:44.216321514 +0000
@@ -1327,6 +1327,7 @@ class SoSReport(object):
         self._finish_logging()
         # package up the results for the support organization
         if not self.opts.build:
+            old_umask = os.umask(0o077)
             if not self.opts.quiet:
                 print(_("Creating compressed archive..."))
             # compression could fail for a number of reasons
@@ -1345,6 +1346,8 @@ class SoSReport(object):
                     raise
                 else:
                     return False
+            finally:
+                os.umask(old_umask)
         else:
             final_filename = self.archive.get_archive_path()
         self.policy.display_results(final_filename, build=self.opts.build)

Comment 4 Bryn M. Reeves 2014-10-30 16:57:21 UTC

Fixed upstream:

commit d7759d3ddae5fe99a340c88a1d370d65cfa73fd6
Author: Bryn M. Reeves <bmr>
Date:   Thu Oct 30 16:46:01 2014 +0000

    [sosreport] fix archive permissions regression
    
    Restore the umask save/restore around archive creation and ensure
    the effective umask is 077 at the time of archive creation.
    
    Fixes #425.
    
    Signed-off-by: Bryn M. Reeves <bmr>

Comment 8 errata-xmlrpc 2015-03-05 11:24:00 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0532.html