public inbox for gentoo-portage-dev@lists.gentoo.org
 help / color / mirror / Atom feed
* [gentoo-portage-dev] [PATCH] _prepare_workdir: apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR (bug 692492)
@ 2020-03-15  0:46 Zac Medico
  0 siblings, 0 replies; only message in thread
From: Zac Medico @ 2020-03-15  0:46 UTC (permalink / raw
  To: gentoo-portage-dev; +Cc: Zac Medico

Apply secure PORTAGE_WORKDIR_MODE permissions to PORTAGE_BUILDDIR,
since the child directory ${D} and its children may have vulnerable
permissions as reported in bug 692492.

Bug: https://bugs.gentoo.org/692492
Signed-off-by: Zac Medico <zmedico@gentoo.org>
---
 .../package/ebuild/prepare_build_dirs.py      | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lib/portage/package/ebuild/prepare_build_dirs.py b/lib/portage/package/ebuild/prepare_build_dirs.py
index c325819d1..8349d306f 100644
--- a/lib/portage/package/ebuild/prepare_build_dirs.py
+++ b/lib/portage/package/ebuild/prepare_build_dirs.py
@@ -1,4 +1,4 @@
-# Copyright 2010-2018 Gentoo Foundation
+# Copyright 2010-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 from __future__ import unicode_literals
@@ -84,7 +84,7 @@ def prepare_build_dirs(myroot=None, settings=None, cleanup=False):
 			except PortageException:
 				if not os.path.isdir(mydir):
 					raise
-		for dir_key in ("PORTAGE_BUILDDIR", "HOME", "PKG_LOGDIR", "T"):
+		for dir_key in ("HOME", "PKG_LOGDIR", "T"):
 			ensure_dirs(mysettings[dir_key], mode=0o755)
 			apply_secpass_permissions(mysettings[dir_key],
 				uid=portage_uid, gid=portage_gid)
@@ -272,11 +272,18 @@ def _prepare_workdir(mysettings):
 		writemsg(_("!!! Unable to parse PORTAGE_WORKDIR_MODE='%s', using %s.\n") % \
 		(mysettings["PORTAGE_WORKDIR_MODE"], oct(workdir_mode)))
 	mysettings["PORTAGE_WORKDIR_MODE"] = oct(workdir_mode).replace('o', '')
-	try:
-		apply_secpass_permissions(mysettings["WORKDIR"],
-		uid=portage_uid, gid=portage_gid, mode=workdir_mode)
-	except FileNotFound:
-		pass # ebuild.sh will create it
+
+	permissions = {'mode': workdir_mode}
+	if portage.data.secpass >= 2:
+		permissions['uid'] = portage_uid
+	if portage.data.secpass >= 1:
+		permissions['gid'] = portage_gid
+
+	# Apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR, since the child
+	# directory ${D} and its children may have vulnerable permissions
+	# as reported in bug 692492.
+	ensure_dirs(mysettings["PORTAGE_BUILDDIR"], **permissions)
+	ensure_dirs(mysettings["WORKDIR"], **permissions)
 
 	if mysettings.get("PORTAGE_LOGDIR", "") == "":
 		while "PORTAGE_LOGDIR" in mysettings:
-- 
2.24.1



^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2020-03-15  0:48 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-15  0:46 [gentoo-portage-dev] [PATCH] _prepare_workdir: apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR (bug 692492) Zac Medico

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox