diff options
author | elijah <elijah@riseup.net> | 2013-07-29 20:38:58 -0700 |
---|---|---|
committer | elijah <elijah@riseup.net> | 2013-07-29 20:38:58 -0700 |
commit | e00e5d2b501a0d2727ea84fb1ea3e597e1e37ee4 (patch) | |
tree | 92901eec53f76e7bc617e47001977cb1b0b614fe | |
parent | 0f92af724ebab6416fc641b57f0a6d43614c25da (diff) | |
download | leap_cli-e00e5d2b501a0d2727ea84fb1ea3e597e1e37ee4.tar.gz leap_cli-e00e5d2b501a0d2727ea84fb1ea3e597e1e37ee4.tar.bz2 |
security fix - don't allow leap_cli created files to be world/group readable.
-rw-r--r-- | lib/leap_cli/commands/vagrant.rb | 9 | ||||
-rw-r--r-- | lib/leap_cli/config/macros.rb | 4 | ||||
-rw-r--r-- | lib/leap_cli/util.rb | 6 |
3 files changed, 9 insertions, 10 deletions
diff --git a/lib/leap_cli/commands/vagrant.rb b/lib/leap_cli/commands/vagrant.rb index 610574d..7720648 100644 --- a/lib/leap_cli/commands/vagrant.rb +++ b/lib/leap_cli/commands/vagrant.rb @@ -76,8 +76,7 @@ module LeapCli; module Commands Util.assert_files_exist! file_path uid = File.new(file_path).stat.uid if uid == 0 || uid == Process.euid - FileUtils.cp file_path, '/tmp/vagrant.key' - FileUtils.chmod 0600, '/tmp/vagrant.key' + FileUtils.install file_path, '/tmp/vagrant.key', :mode => 0600 file_path = '/tmp/vagrant.key' end return file_path @@ -112,7 +111,7 @@ module LeapCli; module Commands def vagrant_setup assert_bin! 'vagrant', 'Vagrant is required for running local virtual machines. Run "sudo apt-get install vagrant".' - version = vagrant_version + version = vagrant_version case version when 0..1 unless assert_run!('vagrant gem which sahara').chars.any? @@ -131,7 +130,7 @@ module LeapCli; module Commands def vagrant_version minor_version = `vagrant --version|cut -d' ' -f 3 | cut -d'.' -f 2`.to_i version = case minor_version - when 1..9 then 2 + when 1..9 then 2 when 0 then 1 else 0 end @@ -179,7 +178,7 @@ module LeapCli; module Commands lines << %[ end] end end - end + end lines << %[end] lines << "" diff --git a/lib/leap_cli/config/macros.rb b/lib/leap_cli/config/macros.rb index b5f6a34..ef3a85e 100644 --- a/lib/leap_cli/config/macros.rb +++ b/lib/leap_cli/config/macros.rb @@ -97,8 +97,8 @@ module LeapCli; module Config # if file is under Path.provider_base, we must copy the default file to # to Path.provider in order for rsync to be able to sync the file. local_provider_path = actual_path.sub(/^#{Regexp.escape(Path.provider_base)}/, Path.provider) - FileUtils.mkdir_p File.dirname(local_provider_path) - FileUtils.cp_r actual_path, local_provider_path + FileUtils.mkdir_p File.dirname(local_provider_path), :mode => 0700 + FileUtils.install actual_path, local_provider_path, :mode => 0600 Util.log :created, Path.relative_path(local_provider_path) actual_path = local_provider_path end diff --git a/lib/leap_cli/util.rb b/lib/leap_cli/util.rb index e52c8a1..86a9a14 100644 --- a/lib/leap_cli/util.rb +++ b/lib/leap_cli/util.rb @@ -162,7 +162,7 @@ module LeapCli dir = Path.named_path(dir) unless File.directory?(dir) assert_files_missing!(dir, :msg => "Cannot create directory #{dir}") - FileUtils.mkdir_p(dir) + FileUtils.mkdir_p(dir, :mode => 0700) unless dir =~ /\/$/ dir = dir + '/' end @@ -219,7 +219,7 @@ module LeapCli write_file!(filepath, content) end else - File.open(filepath, File::RDWR|File::CREAT, 0644) do |f| + File.open(filepath, File::RDWR|File::CREAT, 0600) do |f| f.flock(File::LOCK_EX) old_content = f.read new_content = yield(old_content) @@ -286,7 +286,7 @@ module LeapCli end end - File.open(filepath, 'w') do |f| + File.open(filepath, 'w', 0600) do |f| f.write contents end |