Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-)
New commits: commit e588ccb44331e41cfde3fffa29ffea67b31e9307 Author: Brian C. Lane <[email protected]> Date: Thu May 23 07:20:46 2013 -0700 Version 13.4.4 diff --git a/Makefile b/Makefile index 2abfac3..9c88497 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ -VERSION = 13.4.3 +VERSION = 13.4.4 INSTALL = /usr/bin/install -c INSTALL_PROGRAM = ${INSTALL} commit e9c44265407e63d76c9bc811f2098e036cc68438 Author: Tomas Hoger <[email protected]> Date: Thu May 16 11:16:35 2013 -0700 Avoid setting empty root password (#962493) When using kickstart with no rootpw command, imgcreate ended up calling "passwd -d root", leaving the root account password-less. That may lead to local or remote privilege escalation. This change does the following: 1) There's no password manipulation done when password is empty string and rootpw was not called with --iscrypted 2) Password is locked when "rootpw --lock" is used Notes: Users can still shoot themselves in a foot by using: rootpw --iscrypted "" Resolves: rhbz#962493 Signed-off-by: Brian C. Lane <[email protected]> diff --git a/imgcreate/kickstart.py b/imgcreate/kickstart.py index 41c97ee..4abba6b 100644 --- a/imgcreate/kickstart.py +++ b/imgcreate/kickstart.py @@ -192,9 +192,9 @@ class FirewallConfig(KickstartConfig): class RootPasswordConfig(KickstartConfig): """A class to apply a kickstart root password configuration to a system.""" - def unset(self): - self.call(["/usr/bin/passwd", "-d", "root"]) - + def lock(self): + self.call(["/usr/bin/passwd", "-l", "root"]) + def set_encrypted(self, password): self.call(["/usr/sbin/usermod", "-p", password, "root"]) @@ -217,8 +217,9 @@ class RootPasswordConfig(KickstartConfig): self.set_encrypted(ksrootpw.password) elif ksrootpw.password != "": self.set_unencrypted(ksrootpw.password) - else: - self.unset() + + if ksrootpw.lock: + self.lock() class ServicesConfig(KickstartConfig): """A class to apply a kickstart services configuration to a system.""" -- livecd mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/livecd
