Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix permissions check #1170

Merged
merged 1 commit into from
May 1, 2022
Merged

fix permissions check #1170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 54 additions & 46 deletions cmd/skywire-cli/commands/config/gen.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,8 @@ var genConfigCmd = &cobra.Command{
if output == visorconfig.StdoutName {
stdout = true
force = false
}
if stdout {
regen = false
}
//hide defeats the purpose of stdout.
Expand Down Expand Up @@ -189,11 +191,57 @@ var genConfigCmd = &cobra.Command{
logger.Info("Ignoring -f --force flag, config not found.")
}
}
if !regen {
//check if the config exists
if _, err := os.Stat(confPath); err == nil {
//error config exists !regen
logger.Fatal("Config file already exists. Specify the '-r --regen' flag to regenerate.")
}
// skywire-cli config gen -p
if !stdout && outunset {
if pkgEnv && (selectedOS == "linux") {
configName = skyenv.Configjson
confPath = skyenv.SkywirePath + "/" + configName
output = confPath
}
if usrEnv {
confPath = skyenv.HomePath() + "/" + skyenv.ConfigName
output = confPath
}
}
if !regen && !stdout {
//check if the config exists
if _, err := os.Stat(confPath); err == nil {
//error config exists !regen
logger.Fatal("Config file already exists. Specify the '-r --regen' flag to regenerate.")
}
}
//don't write file with stdout
if !stdout {
if skyenv.OS == "linux" {
userLvl, err := user.Current()
if err != nil {
logger.WithError(err).Error("Failed to detect user.")
} else {
if userLvl.Username == "root" {
root = true
}
}
//warn when writing config as root to non root owned dir & fail on the reverse instance
if _, err = exec.LookPath("stat"); err == nil {
confPath1, _ := filepath.Split(confPath)
if confPath1 == "" {
confPath1 = "./"
}
owner, err := script.Exec(`stat -c '%U' ` + confPath1).String()
if err != nil {
logger.Error("cannot stat: " + confPath1)
}
rootOwner, err := script.Exec(`stat -c '%U' /root`).String()
if err != nil {
logger.Error("cannot stat: /root")
}
if (owner != rootOwner) && root {
logger.Warn("writing config as root to directory not owned by root")
}
if !root && (owner == rootOwner) {
logger.Fatal("Insufficient permissions to write to the specified path")
}
}
}
}
Expand All @@ -207,16 +255,6 @@ var genConfigCmd = &cobra.Command{
}
//fetch the service endpoints
services = visorconfig.Fetch(mLog, serviceConfURL, stdout)
// skywire-cli config gen -p
if !stdout && outunset {
if pkgEnv && (selectedOS == "linux") {
configName = skyenv.Configjson
confPath = skyenv.SkywirePath + "/" + configName
}
if usrEnv {
confPath = skyenv.HomePath() + "/" + skyenv.ConfigName
}
}
// Read in old config and obtain old secret key or generate a new random secret key
// and obtain old hypervisors (if any)
var sk cipher.SecKey
Expand Down Expand Up @@ -301,7 +339,7 @@ var genConfigCmd = &cobra.Command{
}
}
}
// Disable apps listed on --disable-apps flag
// Disable apps --disable-apps flag
if disableApps != "" {
apps := strings.Split(disableApps, ",")
appsSlice := make(map[string]bool)
Expand All @@ -318,9 +356,6 @@ var genConfigCmd = &cobra.Command{
}
// Set EnableAuth true hypervisor UI by --enable-auth flag
if hypervisor {
if pkgEnv {
conf.Hypervisor.EnableAuth = true
}
// Make false EnableAuth hypervisor UI by --disable-auth flag
if disableauth {
conf.Hypervisor.EnableAuth = false
Expand All @@ -341,33 +376,6 @@ var genConfigCmd = &cobra.Command{
}
//don't write file with stdout
if !stdout {
userLvl, err := user.Current()
if err != nil {
logger.WithError(err).Error("Failed to detect user.")
} else {
if userLvl.Username == "root" {
root = true
}
}
//dont write config as root to non root owned dir & vice versa
if _, err = exec.LookPath("stat"); err == nil {

confPath1, _ := filepath.Split(confPath)
if confPath1 == "" {
confPath1 = "./"
}
owner, err := script.Exec(`stat -c '%U' ` + confPath1).String()
if err != nil {
logger.Error("cannot stat: " + confPath1)
}
if ((owner != "root") || (owner != "root\n")) && root {
logger.Fatal("declined writing config as root to directory not owned by root")
}
if !root && ((owner == "root") || (owner == "root\n")) {
logger.Fatal("Insufficient permissions to write to the specified path")
}
}

// Save config to file.
if err := conf.Flush(); err != nil {
logger.WithError(err).Fatal("Failed to flush config to file.")
Expand Down
45 changes: 22 additions & 23 deletions cmd/skywire-visor/commands/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,29 +218,28 @@ func runVisor(conf *visorconfig.V1) {
if conf == nil {
conf = initConfig(log, confPath)
}
//warn about creating files & directories as root in non root-owned dir
//dont write config as root to non root owned dir & vice versa
if _, err := exec.LookPath("stat"); err == nil {
confPath1, _ := filepath.Split(conf.LocalPath)
if confPath1 == "" {
confPath1 = "./"
}
owner, err := script.Exec(`stat -c '%U' ` + confPath1).String()
if err != nil {
log.Error("cannot stat: " + confPath1)
}
rootOwner, err := script.Exec(`stat -c '%U' /root`).String()
if err != nil {
log.Error("cannot stat: /root")
}
if (owner != rootOwner) && root {
log.WithField("local path", conf.LocalPath).Warn()
log.Warn("writing as root to local path not owned by root")
}
if !root && (owner == rootOwner) {
log.WithField("local path", conf.LocalPath).WithField("owner", "root").Error("folder belongs to root")
log.WithField("visor is root", root).Error("visor not started as root")
log.Fatal("Insufficient permissions to write to the specified path")

if skyenv.OS == "linux" {
//warn about creating files & directories as root in non root-owned dir
if _, err := exec.LookPath("stat"); err == nil {
confPath1, _ := filepath.Split(confPath)
if confPath1 == "" {
confPath1 = "./"
}
owner, err := script.Exec(`stat -c '%U' ` + confPath1).String()
if err != nil {
log.Error("cannot stat: " + confPath1)
}
rootOwner, err := script.Exec(`stat -c '%U' /root`).String()
if err != nil {
log.Error("cannot stat: /root")
}
if (owner != rootOwner) && root {
log.Warn("writing config as root to directory not owned by root")
}
if !root && (owner == rootOwner) {
log.Fatal("Insufficient permissions to write to the specified path")
}
}
}

Expand Down