Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-)
New commits: commit ca54afa346ed1efd3a10d0933ce9f17b68517978 Author: Brian C. Lane <[email protected]> Date: Thu May 23 06:28:00 2013 -0700 Version 17.17 diff --git a/Makefile b/Makefile index 935249e..3a34806 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ -VERSION = 17.16 +VERSION = 17.17 INSTALL = /usr/bin/install -c INSTALL_PROGRAM = ${INSTALL} commit 132b59b2b5587eee0c8f66abea4bed28532f30e4 Author: Tomas Hoger <[email protected]> Date: Thu May 23 05:56:11 2013 -0700 Avoid setting empty root password (#964299) When using kickstart with no rootpw command, imgcreate ended up calling "passwd -d root", leaving the root account password-less. That may lead to local or remote privilege escalation. This change does the following: 1) There's no password manipulation done when password is empty string and rootpw was not called with --iscrypted 2) Password is locked when "rootpw --lock" is used Notes: Users can still shoot themselves in a foot by using: rootpw --iscrypted "" Resolves: rhbz#964299 (CVE-2013-2069) Signed-off-by: Brian C. Lane <[email protected]> diff --git a/imgcreate/kickstart.py b/imgcreate/kickstart.py index 5195e6a..3d4bbf6 100644 --- a/imgcreate/kickstart.py +++ b/imgcreate/kickstart.py @@ -199,9 +199,9 @@ class FirewallConfig(KickstartConfig): class RootPasswordConfig(KickstartConfig): """A class to apply a kickstart root password configuration to a system.""" - def unset(self): - self.call(["/usr/bin/passwd", "-d", "root"]) - + def lock(self): + self.call(["/usr/bin/passwd", "-l", "root"]) + def set_encrypted(self, password): self.call(["/usr/sbin/usermod", "-p", password, "root"]) @@ -224,8 +224,9 @@ class RootPasswordConfig(KickstartConfig): self.set_encrypted(ksrootpw.password) elif ksrootpw.password != "": self.set_unencrypted(ksrootpw.password) - else: - self.unset() + + if ksrootpw.lock: + self.lock() class ServicesConfig(KickstartConfig): """A class to apply a kickstart services configuration to a system.""" -- livecd mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/livecd
