-
Notifications
You must be signed in to change notification settings - Fork 4.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Backport of Vault 3992 ToB Config and Plugins Permissions into releas…
…e/1.10.x (#14881) * backport of commit 903a4f3 * backport of commit 81df08b * backport of commit 5632e2d * backport of commit 4a7a911 Co-authored-by: akshya96 <[email protected]> Co-authored-by: akshya96 <[email protected]>
- Loading branch information
3 people
authored
Apr 4, 2022
1 parent
e18b382
commit a43b8ee
Showing
19 changed files
with
443 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| ```release-note:improvement | ||
| core : check uid and permissions of config dir, config file, plugin dir and plugin binaries | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package osutil | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "io/fs" | ||
| "os" | ||
| ) | ||
|
|
||
| func IsWriteGroup(mode os.FileMode) bool { | ||
| return mode&0o20 != 0 | ||
| } | ||
|
|
||
| func IsWriteOther(mode os.FileMode) bool { | ||
| return mode&0o02 != 0 | ||
| } | ||
|
|
||
| func checkPathInfo(info fs.FileInfo, path string, uid int, permissions int) error { | ||
| err := FileUidMatch(info, path, uid) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| err = FilePermissionsMatch(info, path, permissions) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func FilePermissionsMatch(info fs.FileInfo, path string, permissions int) error { | ||
| if permissions != 0 && int(info.Mode().Perm()) != permissions { | ||
| return fmt.Errorf("path %q does not have permissions %o", path, permissions) | ||
| } | ||
| if permissions == 0 && (IsWriteOther(info.Mode()) || IsWriteGroup(info.Mode())) { | ||
| return fmt.Errorf("path %q has insecure permissions %o. Vault expects no write permissions for group or others", path, info.Mode().Perm()) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // OwnerPermissionsMatch checks if vault user is the owner and permissions are secure for input path | ||
| func OwnerPermissionsMatch(path string, uid int, permissions int) error { | ||
| if path == "" { | ||
| return fmt.Errorf("could not verify permissions for path. No path provided ") | ||
| } | ||
|
|
||
| info, err := os.Stat(path) | ||
| if err != nil { | ||
| return fmt.Errorf("error stating %q: %w", path, err) | ||
| } | ||
| if info.Mode()&os.ModeSymlink != 0 { | ||
| symLinkInfo, err := os.Lstat(path) | ||
| if err != nil { | ||
| return fmt.Errorf("error stating %q: %w", path, err) | ||
| } | ||
| err = checkPathInfo(symLinkInfo, path, uid, permissions) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| } | ||
| err = checkPathInfo(info, path, uid, permissions) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| package osutil | ||
|
|
||
| import ( | ||
| "io/fs" | ||
| "os" | ||
| "os/user" | ||
| "runtime" | ||
| "strconv" | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestCheckPathInfo(t *testing.T) { | ||
| currentUser, err := user.Current() | ||
| if err != nil { | ||
| t.Errorf("failed to get details of current process owner. The error is: %v", err) | ||
| } | ||
| uid, err := strconv.ParseInt(currentUser.Uid, 0, 64) | ||
| if err != nil { | ||
| t.Errorf("failed to convert uid to int64. The error is: %v", err) | ||
| } | ||
| uid2, err := strconv.ParseInt(currentUser.Uid+"1", 0, 64) | ||
| if err != nil { | ||
| t.Errorf("failed to convert uid to int64. The error is: %v", err) | ||
| } | ||
|
|
||
| testCases := []struct { | ||
| uid int | ||
| filepermissions fs.FileMode | ||
| permissions int | ||
| expectError bool | ||
| }{ | ||
| { | ||
| uid: 0, | ||
| filepermissions: 0o700, | ||
| permissions: 0, | ||
| expectError: false, | ||
| }, | ||
| { | ||
| uid: int(uid2), | ||
| filepermissions: 0o700, | ||
| permissions: 0, | ||
| expectError: true, | ||
| }, | ||
| { | ||
| uid: int(uid), | ||
| filepermissions: 0o700, | ||
| permissions: 0, | ||
| expectError: false, | ||
| }, | ||
| { | ||
| uid: 0, | ||
| filepermissions: 0o777, | ||
| permissions: 744, | ||
| expectError: true, | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range testCases { | ||
| err := os.Mkdir("testFile", tc.filepermissions) | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| info, err := os.Stat("testFile") | ||
| if err != nil { | ||
| t.Errorf("error stating %q: %v", "testFile", err) | ||
| } | ||
| if tc.uid != 0 && runtime.GOOS == "windows" && tc.expectError == true { | ||
| t.Skip("Skipping test in windows environment as no error will be returned in this case") | ||
| } | ||
|
|
||
| err = checkPathInfo(info, "testFile", tc.uid, int(tc.permissions)) | ||
| if tc.expectError && err == nil { | ||
| t.Errorf("invalid result. expected error") | ||
| } | ||
| if !tc.expectError && err != nil { | ||
| t.Errorf(err.Error()) | ||
| } | ||
|
|
||
| err = os.RemoveAll("testFile") | ||
| if err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| //go:build !windows | ||
|
|
||
| package osutil | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "io/fs" | ||
| "os/user" | ||
| "strconv" | ||
| "syscall" | ||
| ) | ||
|
|
||
| func FileUIDEqual(info fs.FileInfo, uid int) bool { | ||
| if stat, ok := info.Sys().(*syscall.Stat_t); ok { | ||
| path_uid := int(stat.Uid) | ||
| if path_uid == uid { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func FileGIDEqual(info fs.FileInfo, gid int) bool { | ||
| if stat, ok := info.Sys().(*syscall.Stat_t); ok { | ||
| path_gid := int(stat.Gid) | ||
| if path_gid == gid { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func FileUidMatch(info fs.FileInfo, path string, uid int) (err error) { | ||
| currentUser, err := user.Current() | ||
| if err != nil { | ||
| return fmt.Errorf("failed to get details of current process owner. The error is: %w", err) | ||
| } | ||
| switch uid { | ||
| case 0: | ||
| currentUserUid, err := strconv.Atoi(currentUser.Uid) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to convert uid %q to int. The error is: %w", currentUser.Uid, err) | ||
| } | ||
| if !FileUIDEqual(info, currentUserUid) { | ||
| return fmt.Errorf("path %q is not owned by my uid %s", path, currentUser.Uid) | ||
| } | ||
| default: | ||
| if !FileUIDEqual(info, uid) { | ||
| return fmt.Errorf("path %q is not owned by uid %d", path, uid) | ||
| } | ||
| } | ||
| return err | ||
| } |
Oops, something went wrong.