Bug 1260778 - virt-builder --ssh-inject doesn't set proper permissions on created files
Summary: virt-builder --ssh-inject doesn't set proper permissions on created files
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libguestfs
Version: 23
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Richard W.M. Jones
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1260801
TreeView+ depends on / blocked
 
Reported: 2015-09-07 17:29 UTC by Ryan Sawhill
Modified: 2015-11-08 09:49 UTC (History)
6 users (show)

Fixed In Version: libguestfs-1.30.2-1.fc23 libguestfs-1.30.4-1.fc22
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1260801 (view as bug list)
Environment:
Last Closed: 2015-11-08 09:49:23 UTC
Type: Bug


Attachments (Terms of Use)

Description Ryan Sawhill 2015-09-07 17:29:03 UTC
Description of problem:

  When using virt-builder --ssh-inject, the permissions of ~/.ssh and ~/.ssh/authorized_keys are not set appropriately.

Version-Release number of selected component (if applicable):

  Checked in latest available Fedora non-testing version
  (libguestfs-tools-c-1.30.0-1.fc22.x86_64)

How reproducible:

  Hmmm. 100% it seems.

Steps to Reproduce:

  1. virt-builder <TEMPLATE> --ssh-inject root
  2. Import image with virt-install or use guestfish/guestmount to pull up rootfs
  3. Execute: ls -la /root/.ssh

Actual results:

  total 4
  drwxr-xr-x. 2 root root  28 Sep  7 13:04 .
  dr-xr-x---. 3 root root  97 Sep  7 13:04 ..
  -rw-r--r--. 1 root root 397 Sep  7 13:04 authorized_keys
  
Expected results:

  total 4
  drwx------. 2 root root  28 Sep  7 13:04 .
  dr-xr-x---. 3 root root  97 Sep  7 13:04 ..
  -rw-------. 1 root root 397 Sep  7 13:04 authorized_keys

Comment 1 Richard W.M. Jones 2015-09-07 17:45:02 UTC
In the email conversation we had I thought you meant .ssh was
public writable.

I'm dubious about whether this is really a bug.  On my laptop:

$ ls -ld .ssh
drwxr-xr-x. 2 rjones rjones 4096 Sep  3 17:08 .ssh
$ ls -l .ssh/authorized_keys
-rw-r--r--. 1 rjones rjones 4852 Apr  1 22:16 .ssh/authorized_keys

and I've never imagined that to be a security problem.  These
keys are public keys after all.

For root it's more arguable, although in most cases /root itself
will be unreadable by non-root users so it wouldn't make any difference.

The relevant code is:

https://github.com/libguestfs/libguestfs/blob/master/customize/ssh_key.ml#L118-L130

Comment 2 Ryan Sawhill 2015-09-07 18:05:47 UTC
When the ssh-copy-id command creates ~/.ssh and ~/.ssh/authorized_keys it sets the perms to 0700 and 0600, respectively.

That said, in my email correspondence, I was wrong to suggest that --ssh-inject was failing for me because of this. Turns out it was a quirk of my current setup with ssh-agent and too many keys.

I still think it would be a good idea to set the same perms that ssh-copy-id does, but not that big of a deal I guess.

Comment 3 Richard W.M. Jones 2015-09-07 20:43:13 UTC
I looked at ssh-copy-id and ssh and both are creating ~/.ssh with
mode 0700, so that looks like the right thing to do.

Comment 4 Richard W.M. Jones 2015-09-07 21:17:21 UTC
Patch posted:
https://www.redhat.com/archives/libguestfs/2015-September/msg00021.html

Comment 5 Richard W.M. Jones 2015-09-08 08:46:05 UTC
Upstream fix:
5ed4388ecd5fdb7639622ee4fba317c276547257

Available in libguestfs >= 1.31.5 & >= 1.30.2 (forthcoming).

Comment 6 Fedora Update System 2015-09-08 21:44:54 UTC
libguestfs-1.30.2-1.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15401

Comment 7 Fedora Update System 2015-09-09 06:56:25 UTC
libguestfs-1.30.2-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15420

Comment 8 Fedora Update System 2015-09-10 02:07:46 UTC
libguestfs-1.30.2-1.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update libguestfs'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15401

Comment 9 Fedora Update System 2015-09-10 05:51:47 UTC
libguestfs-1.30.2-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update libguestfs'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15420

Comment 10 Fedora Update System 2015-10-07 11:01:52 UTC
libguestfs-1.30.3-1.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-cdd7fcfc3c

Comment 11 Fedora Update System 2015-10-07 16:25:45 UTC
libguestfs-1.30.3-1.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update libguestfs'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-cdd7fcfc3c

Comment 12 Fedora Update System 2015-10-07 16:37:04 UTC
libguestfs-1.30.2-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2015-10-26 17:31:16 UTC
libguestfs-1.30.4-1.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-f7b0c57297

Comment 14 Fedora Update System 2015-10-28 20:24:56 UTC
libguestfs-1.30.4-1.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update libguestfs'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-f7b0c57297

Comment 15 Fedora Update System 2015-11-08 09:49:14 UTC
libguestfs-1.30.4-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.