commit: ef8c21e59953aa5fdd153f19b7bf04356e2164fe
Author: Zac Medico <zmedico <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 15 00:01:25 2020 +0000
Commit: Zac Medico <zmedico <AT> gentoo <DOT> org>
CommitDate: Sun Mar 15 00:42:43 2020 +0000
URL: https://gitweb.gentoo.org/proj/portage.git/commit/?id=ef8c21e5
_prepare_workdir: apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR (bug 692492)
Apply secure PORTAGE_WORKDIR_MODE permissions to PORTAGE_BUILDDIR,
since the child directory ${D} and its children may have vulnerable
permissions as reported in bug 692492.
Bug: https://bugs.gentoo.org/692492
Signed-off-by: Zac Medico <zmedico <AT> gentoo.org>
lib/portage/package/ebuild/prepare_build_dirs.py | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/lib/portage/package/ebuild/prepare_build_dirs.py
b/lib/portage/package/ebuild/prepare_build_dirs.py
index c325819d1..8349d306f 100644
--- a/lib/portage/package/ebuild/prepare_build_dirs.py
+++ b/lib/portage/package/ebuild/prepare_build_dirs.py
@@ -1,4 +1,4 @@
-# Copyright 2010-2018 Gentoo Foundation
+# Copyright 2010-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
from __future__ import unicode_literals
@@ -84,7 +84,7 @@ def prepare_build_dirs(myroot=None, settings=None,
cleanup=False):
except PortageException:
if not os.path.isdir(mydir):
raise
- for dir_key in ("PORTAGE_BUILDDIR", "HOME", "PKG_LOGDIR", "T"):
+ for dir_key in ("HOME", "PKG_LOGDIR", "T"):
ensure_dirs(mysettings[dir_key], mode=0o755)
apply_secpass_permissions(mysettings[dir_key],
uid=portage_uid, gid=portage_gid)
@@ -272,11 +272,18 @@ def _prepare_workdir(mysettings):
writemsg(_("!!! Unable to parse PORTAGE_WORKDIR_MODE='%s',
using %s.\n") % \
(mysettings["PORTAGE_WORKDIR_MODE"], oct(workdir_mode)))
mysettings["PORTAGE_WORKDIR_MODE"] = oct(workdir_mode).replace('o', '')
- try:
- apply_secpass_permissions(mysettings["WORKDIR"],
- uid=portage_uid, gid=portage_gid, mode=workdir_mode)
- except FileNotFound:
- pass # ebuild.sh will create it
+
+ permissions = {'mode': workdir_mode}
+ if portage.data.secpass >= 2:
+ permissions['uid'] = portage_uid
+ if portage.data.secpass >= 1:
+ permissions['gid'] = portage_gid
+
+ # Apply PORTAGE_WORKDIR_MODE to PORTAGE_BUILDDIR, since the child
+ # directory ${D} and its children may have vulnerable permissions
+ # as reported in bug 692492.
+ ensure_dirs(mysettings["PORTAGE_BUILDDIR"], **permissions)
+ ensure_dirs(mysettings["WORKDIR"], **permissions)
if mysettings.get("PORTAGE_LOGDIR", "") == "":
while "PORTAGE_LOGDIR" in mysettings:
