[
https://issues.apache.org/jira/browse/AMBARI-26622?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jeffrey Smith updated AMBARI-26622:
-----------------------------------
Description:
In sudo.py, the makedir(path, mode) function has different behaviour depending
on if Ambari is running as root or not.
The root branch:
{{def makedir(path, mode):}}
os.mkdir(path)
The non-root branch:
{{def makedir(path, mode):}}
{{ shell.checked_call(["mkdir", path], sudo=True)}}
chmod(path, mode)
This means that when Ambari is running as root, it is silently dropping the
mode option but not doing so when run as any other user. This results in
inconsistent behaviour between these two scenarios.
According to the Python documentation, the default argument for mode is 0o777
if not specified - this could create a situation where a folder is expected to
be secure but is not actually since all users might be able to read/write to
that directory.
({{{}from the docs: os.{}}}{{{}mkdir{}}}({_}path{_}, {_}mode=0o777{_}, {_}*{_},
{_}dir_fd=None{_}))
This is a simple fix - passing mode to {{os.mkdir(path, mode)}} when Ambari
runs as root.
was:
In sudo.py, the makedir(path, mode) function has different behaviour depending
on if Ambari is running as root or not.
The root branch:
{{def makedir(path, mode):}}
{{{}{{ os.mkdir(path)
}}{}}}The non-root branch:{{{}{{
}}{}}}
{{def makedir(path, mode):}}
{{ shell.checked_call(["mkdir", path], sudo=True)}}
{{{} chmod(path, mode)
{}}}This means that when Ambari is running as root, it is silently dropping the
mode option but not doing so when run as any other user. This results in
inconsistent behaviour between these two scenarios.
According to the Python documentation, the default argument for mode is 0o777
if not specified - this could create a situation where a folder is expected to
be secure but is not actually since all users might be able to read/write to
that directory.
({{{}from the docs: os.{}}}{{{}mkdir{}}}({_}path{_}, {_}mode=0o777{_}, {_}*{_},
{_}dir_fd=None{_}))
This is a simple fix - passing mode to {{os.mkdir(path, mode)}} when Ambari
runs as root.
> Inconsistent behaviour between root and non root sudo.py behaviour
> ------------------------------------------------------------------
>
> Key: AMBARI-26622
> URL: https://issues.apache.org/jira/browse/AMBARI-26622
> Project: Ambari
> Issue Type: Bug
> Affects Versions: trunk, 3.0.0, 3.1.0
> Reporter: Jeffrey Smith
> Priority: Major
>
> In sudo.py, the makedir(path, mode) function has different behaviour
> depending on if Ambari is running as root or not.
> The root branch:
> {{def makedir(path, mode):}}
> os.mkdir(path)
> The non-root branch:
> {{def makedir(path, mode):}}
> {{ shell.checked_call(["mkdir", path], sudo=True)}}
> chmod(path, mode)
> This means that when Ambari is running as root, it is silently dropping the
> mode option but not doing so when run as any other user. This results in
> inconsistent behaviour between these two scenarios.
> According to the Python documentation, the default argument for mode is 0o777
> if not specified - this could create a situation where a folder is expected
> to be secure but is not actually since all users might be able to read/write
> to that directory.
> ({{{}from the docs: os.{}}}{{{}mkdir{}}}({_}path{_}, {_}mode=0o777{_},
> {_}*{_}, {_}dir_fd=None{_}))
> This is a simple fix - passing mode to {{os.mkdir(path, mode)}} when Ambari
> runs as root.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
