!29 sync from 2403 sp1

From: @sun_hai_10 
Reviewed-by: @t_feng 
Signed-off-by: @t_feng
This commit is contained in:
openeuler-ci-bot 2025-04-25 08:32:29 +00:00 committed by Gitee
commit 3796135c0d
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
7 changed files with 74 additions and 316 deletions

View File

@ -1,204 +0,0 @@
From 5060981f30e6d1d4c980c89751610dcdffca0dbf Mon Sep 17 00:00:00 2001
From: Enno Gotthold <egotthold@suse.de>
Date: Mon, 30 Sep 2024 10:50:51 +0200
Subject: [PATCH] XML-RPC: Prevent privilege escalation from none to admin
This patch fixes
- GHSA-m26c-fcgh-cp6h
- CVE-2024-47533
It fixes two issues:
1. The encoding keyword argument isn't present when reading in binary mode. We now read in text mode.
2. The login function shouldn't compare the special error value -1 from "utils.get_shared_secret()" to the passed password.
Backported-by: fuowang <wangshuo@kylinos.cn>
---
cobbler/cobblerd.py | 9 +++----
cobbler/remote.py | 2 ++
cobbler/utils.py | 9 +++----
tests/utils_test.py | 27 ++++++++++++++++---
tests/xmlrpcapi/miscellaneous_test.py | 39 +++++++++++++++++++++++++++
5 files changed, 72 insertions(+), 14 deletions(-)
diff --git a/cobbler/cobblerd.py b/cobbler/cobblerd.py
index 9927160..a973ac8 100644
--- a/cobbler/cobblerd.py
+++ b/cobbler/cobblerd.py
@@ -53,13 +53,10 @@ def regen_ss_file():
:return: 1 if this was successful.
"""
ssfile = "/var/lib/cobbler/web.ss"
- fd = open("/dev/urandom", 'rb')
- data = fd.read(512)
- fd.close()
+ data = os.urandom(512)
- fd = os.open(ssfile, os.O_CREAT | os.O_RDWR, 0o660)
- os.write(fd, binascii.hexlify(data))
- os.close(fd)
+ with open(ssfile, 'w', 0o660, encoding="UTF-8") as fd:
+ fd.write(str(binascii.hexlify(data)))
os.chmod(ssfile, 0o660)
http_user = "apache"
diff --git a/cobbler/remote.py b/cobbler/remote.py
index 9ac0f8d..0756c1f 100644
--- a/cobbler/remote.py
+++ b/cobbler/remote.py
@@ -3219,6 +3219,8 @@ class CobblerXMLRPCInterface(object):
"""
# if shared secret access is requested, don't bother hitting the auth plugin
if login_user == "":
+ if self.shared_secret == -1:
+ raise ValueError("login failed(<DIRECT>)")
if login_password == self.shared_secret:
return self.__make_token("<DIRECT>")
else:
diff --git a/cobbler/utils.py b/cobbler/utils.py
index fc1939b..cfed465 100644
--- a/cobbler/utils.py
+++ b/cobbler/utils.py
@@ -2288,13 +2288,12 @@ def get_shared_secret():
:return: The Cobbler secret which enables full access to Cobbler.
:rtype: str
"""
-
try:
- with open("/var/lib/cobbler/web.ss", 'rb', encoding='utf-8') as fd:
- data = fd.read()
- except:
+ with open("/var/lib/cobbler/web.ss", "r", encoding="UTF-8") as web_secret_fd:
+ data = web_secret_fd.read()
+ except Exception:
return -1
- return str(data).strip()
+ return data
def local_get_cobbler_api_url():
diff --git a/tests/utils_test.py b/tests/utils_test.py
index 5df3317..29edc45 100644
--- a/tests/utils_test.py
+++ b/tests/utils_test.py
@@ -1,8 +1,10 @@
+import binascii
import os
import re
import shutil
import time
from pathlib import Path
+from typing import Any, TYPE_CHECKING
import pytest
from netaddr.ip import IPAddress
@@ -17,6 +19,9 @@ from cobbler.items.system import System
from cobbler.cobbler_collections.manager import CollectionManager
from tests.conftest import does_not_raise
+if TYPE_CHECKING:
+ from pytest_mock import MockerFixture
+
def test_pretty_hex():
# Arrange
@@ -1037,15 +1042,31 @@ def test_load_signatures():
assert old_cache != utils.SIGNATURE_CACHE
-def test_get_shared_secret():
+@pytest.mark.parametrize("web_ss_exists", [True, False])
+def test_get_shared_secret(mocker: "MockerFixture", web_ss_exists: bool):
# Arrange
- # TODO: Test the case where the file is there.
+ open_mock = mocker.mock_open()
+ random_data = binascii.hexlify(os.urandom(512)).decode()
+ mock_web_ss = mocker.mock_open(read_data=random_data)
+
+ def mock_open(*args: Any, **kwargs: Any):
+ if not web_ss_exists:
+ open_mock.side_effect = FileNotFoundError
+ return open_mock(*args, **kwargs)
+ if args[0] == "/var/lib/cobbler/web.ss":
+ return mock_web_ss(*args, **kwargs)
+ return open_mock(*args, **kwargs)
+
+ mocker.patch("builtins.open", mock_open)
# Act
result = utils.get_shared_secret()
# Assert
- assert result == -1
+ if web_ss_exists:
+ assert result == random_data
+ else:
+ assert result == -1
def test_local_get_cobbler_api_url():
diff --git a/tests/xmlrpcapi/miscellaneous_test.py b/tests/xmlrpcapi/miscellaneous_test.py
index 1cdf249..3c0c917 100644
--- a/tests/xmlrpcapi/miscellaneous_test.py
+++ b/tests/xmlrpcapi/miscellaneous_test.py
@@ -1,11 +1,15 @@
import json
import os
import time
+from typing import Any
import pytest
+from cobbler.remote import CobblerXMLRPCInterface
from cobbler.utils import get_shared_secret
+from tests.conftest import does_not_raise
+
@pytest.mark.usefixtures("cobbler_xmlrpc_base")
class TestMiscellaneous:
@@ -355,6 +359,41 @@ class TestMiscellaneous:
# Assert
assert not result
+ @pytest.mark.parametrize(
+ "input_username,input_password,expected_result,expected_exception,web_ss_exists",
+ [
+ ("cobbler", "cobbler", True, does_not_raise(), True),
+ ("cobbler", "incorrect-password", True, pytest.raises(ValueError), True),
+ ("", "doesnt-matter", True, pytest.raises(ValueError), True),
+ ("", "my-random-web-ss", True, does_not_raise(), True),
+ ("", "my-random-web-ss", True, pytest.raises(ValueError), False),
+ ],
+ )
+ def test_login(
+ self,
+ remote: CobblerXMLRPCInterface,
+ input_username: str,
+ input_password: str,
+ expected_result: Any,
+ expected_exception: Any,
+ web_ss_exists: bool
+ ):
+ """
+ Assert that the login is working successfully with correct and incorrect credentials.
+ """
+ # Arrange
+ if web_ss_exists:
+ remote.shared_secret = "my-random-web-ss"
+ else:
+ remote.shared_secret = -1
+
+ # Act
+ with expected_exception:
+ token = remote.login(input_username, input_password)
+
+ # Assert
+ assert remote.token_check(token) == expected_result
+
def test_logout(self, remote):
# Arrange
shared_secret = get_shared_secret()
--
2.27.0

View File

@ -1,24 +0,0 @@
From a35a9fed3612482e0bd6931920fb730bae3a8195 Mon Sep 17 00:00:00 2001
From: sun_hai_10 <sunhai10@huawei.com>
Date: Thu, 9 Mar 2023 14:33:53 +0800
Subject: [PATCH] change permission with web.ss
---
cobbler/cobblerd.py | 1 +
1 file changed, 1 insertion(+)
diff --git a/cobbler/cobblerd.py b/cobbler/cobblerd.py
index 34aedf9..9927160 100644
--- a/cobbler/cobblerd.py
+++ b/cobbler/cobblerd.py
@@ -60,6 +60,7 @@ def regen_ss_file():
fd = os.open(ssfile, os.O_CREAT | os.O_RDWR, 0o660)
os.write(fd, binascii.hexlify(data))
os.close(fd)
+ os.chmod(ssfile, 0o660)
http_user = "apache"
family = utils.get_family()
--
2.23.0

Binary file not shown.

BIN
cobbler-3.2.3.tar.gz Normal file

Binary file not shown.

View File

@ -3,8 +3,8 @@
%global vendor_lower `echo %{_vendor}|tr 'A-Z' 'a-z'`
Name: cobbler
Version: 3.2.0
Release: 5
Version: 3.2.3
Release: 2
Summary: Boot server configurator
URL: https://cobbler.github.io/
License: GPLv2+
@ -13,10 +13,8 @@ BuildArch: noarch
Patch9000: huawei-adapt-vendor.patch
Patch9001: huawei-repair-switch-condition-error.patch
Patch6000: fix-Give-root-RW-permissions-to-var-lib-cobbler-web.ss.patch
Patch9002: bugfix-change-permission-with-web.ss.patch
Patch6001: backport-Fix-package-building-with-Sphinx.patch
Patch6002: backport-XML-RPC-Prevent-privilege-escalation-from-none-to-ad.patch
BuildRequires: system-release
BuildRequires: python%{python3_pkgversion}-devel
@ -186,7 +184,6 @@ sed -i -e "s/SECRET_KEY = ''/SECRET_KEY = \'$RAND_SECRET\'/" %{_datadir}/cobbler
%{_bindir}/cobbler-ext-nodes
%{_bindir}/cobblerd
%{_sbindir}/tftpd.py
%{_sbindir}/fence_ipmitool
%{_datadir}/bash-completion/
%dir %{_datadir}/cobbler
%{_datadir}/cobbler/bin
@ -210,6 +207,18 @@ sed -i -e "s/SECRET_KEY = ''/SECRET_KEY = \'$RAND_SECRET\'/" %{_datadir}/cobbler
%attr(-,apache,apache) /var/www/cobbler_webui_content/
%changelog
* Wed Apr 23 2025 sunhai <sunhai10@huawei.com> - 3.2.3-2
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:fix start cobbler failed
* Tue Apr 22 2025 sunhai <sunhai10@huawei.com> - 3.2.3-1
- Type:bugfix
- ID:NA
- SUG:NA
- DESC:update to 3.2.3
* Wed Nov 20 2024 wangshuo <wangshuo@kylinos.cn> - 3.2.0-5
- Type:CVE
- ID:CVE-2024-47533

View File

@ -1,25 +0,0 @@
From d63ed9f9712bfbdc9b36e2f3dc94bc8bb4ba0a80 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Sun, 25 Oct 2020 11:43:25 -0600
Subject: [PATCH] Give root RW permissions to /var/lib/cobbler/web.ss
---
cobbler/cobblerd.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cobbler/cobblerd.py b/cobbler/cobblerd.py
index fe1cf88..34aedf9 100644
--- a/cobbler/cobblerd.py
+++ b/cobbler/cobblerd.py
@@ -57,7 +57,7 @@ def regen_ss_file():
data = fd.read(512)
fd.close()
- fd = os.open(ssfile, os.O_CREAT | os.O_RDWR, 0o600)
+ fd = os.open(ssfile, os.O_CREAT | os.O_RDWR, 0o660)
os.write(fd, binascii.hexlify(data))
os.close(fd)
--
2.30.0

View File

@ -1,6 +1,6 @@
From 39793327e0f859dc613f9ff69e3f91e6a7be086c Mon Sep 17 00:00:00 2001
From: bitcoffee <liuxin264@huawei.com>
Date: Tue, 29 Jun 2021 00:43:34 +0800
From 704be6fc9efd009c8f1da9abdb626e7fb18c86bb Mon Sep 17 00:00:00 2001
From: sun_hai_10 <sunhai10@huawei.com>
Date: Fri, 28 Mar 2025 01:51:43 +0800
Subject: [PATCH] adapt vendor
---
@ -9,17 +9,17 @@ Subject: [PATCH] adapt vendor
cobbler/actions/reposync.py | 2 +-
cobbler/autoinstallgen.py | 2 +-
cobbler/tftpgen.py | 2 +-
cobbler/utils.py | 3 +++
cobbler/utils.py | 4 +++-
config/cobbler/distro_signatures.json | 28 +++++++++++++++++++++++++++
distro_build_configs.sh | 5 ++++-
templates/etc/dhcp.template | 10 +++++-----
9 files changed, 55 insertions(+), 21 deletions(-)
9 files changed, 55 insertions(+), 22 deletions(-)
diff --git a/cobbler/actions/buildiso.py b/cobbler/actions/buildiso.py
index 9500086..be42749 100644
index f1be922..e469535 100644
--- a/cobbler/actions/buildiso.py
+++ b/cobbler/actions/buildiso.py
@@ -228,7 +228,7 @@ class BuildIso(object):
@@ -220,7 +220,7 @@ class BuildIso:
else:
append_line += " autoyast=%s" % data["autoinstall"]
@ -27,8 +27,8 @@ index 9500086..be42749 100644
+ if dist.breed == "redhat" or dist.breed == "generic_lower_os":
if "proxy" in data and data["proxy"] != "":
append_line += " proxy=%s http_proxy=%s" % (data["proxy"], data["proxy"])
append_line += " ks=%s" % data["autoinstall"]
@@ -278,7 +278,7 @@ class BuildIso(object):
if dist.os_version in ["rhel4", "rhel5", "rhel6", "fedora16"]:
@@ -273,7 +273,7 @@ class BuildIso:
else:
append_line += " autoyast=%s" % data["autoinstall"]
@ -36,8 +36,8 @@ index 9500086..be42749 100644
+ if dist.breed == "redhat" or dist.breed == "generic_lower_os":
if "proxy" in data and data["proxy"] != "":
append_line += " proxy=%s http_proxy=%s" % (data["proxy"], data["proxy"])
append_line += " ks=%s" % data["autoinstall"]
@@ -314,7 +314,7 @@ class BuildIso(object):
if dist.os_version in ["rhel4", "rhel5", "rhel6", "fedora16"]:
@@ -312,7 +312,7 @@ class BuildIso:
my_mask = None
my_gw = None
my_dns = None
@ -46,7 +46,7 @@ index 9500086..be42749 100644
if "netmask" in data["kernel_options"] and data["kernel_options"]["netmask"] != "":
my_mask = data["kernel_options"]["netmask"]
del data["kernel_options"]["netmask"]
@@ -322,7 +322,7 @@ class BuildIso(object):
@@ -320,7 +320,7 @@ class BuildIso:
my_gw = data["kernel_options"]["gateway"]
del data["kernel_options"]["gateway"]
@ -55,7 +55,7 @@ index 9500086..be42749 100644
if "ksdevice" in data["kernel_options"] and data["kernel_options"]["ksdevice"] != "":
my_int = data["kernel_options"]["ksdevice"]
if my_int == "bootif":
@@ -424,7 +424,7 @@ class BuildIso(object):
@@ -422,7 +422,7 @@ class BuildIso:
append_line += " netdevice=%s" % data["mac_address_" + my_int].lower()
else:
append_line += " netdevice=%s" % my_int
@ -64,7 +64,7 @@ index 9500086..be42749 100644
if intmac in data and data[intmac] != "":
append_line += " ksdevice=%s" % data["mac_address_" + my_int]
else:
@@ -435,19 +435,19 @@ class BuildIso(object):
@@ -433,19 +433,19 @@ class BuildIso:
if my_ip is not None:
if dist.breed == "suse":
append_line += " hostip=%s" % my_ip
@ -87,7 +87,7 @@ index 9500086..be42749 100644
append_line += " gateway=%s" % my_gw
if dist.breed in ["ubuntu", "debian"]:
append_line += " netcfg/get_gateway=%s" % my_gw
@@ -458,7 +458,7 @@ class BuildIso(object):
@@ -456,7 +456,7 @@ class BuildIso:
append_line += " nameserver=%s" % ",".join(my_dns)
else:
append_line += " nameserver=%s" % my_dns
@ -96,55 +96,55 @@ index 9500086..be42749 100644
if type(my_dns) == list:
append_line += " dns=%s" % ",".join(my_dns)
else:
@@ -548,7 +548,7 @@ class BuildIso(object):
@@ -545,7 +545,7 @@ class BuildIso:
cfg.write(" kernel %s\n" % os.path.basename(distro.kernel))
append_line = " append initrd=%s" % os.path.basename(distro.initrd)
- if distro.breed == "redhat":
+ if distro.breed == "redhat" or distro.breed == "generic_lower_os":
append_line += " ks=cdrom:/isolinux/%s.cfg" % descendant.name
if distro.breed == "suse":
append_line += " autoyast=file:///isolinux/%s.cfg install=cdrom:///" % descendant.name
@@ -566,7 +566,7 @@ class BuildIso(object):
+ if distro.breed == "redhat" or dist.breed == "generic_lower_os":
if distro.os_version in ["rhel4", "rhel5", "rhel6", "fedora16"]:
append_line += " ks=cdrom:/isolinux/%s.cfg" % descendant.name
else:
@@ -566,7 +566,7 @@ class BuildIso:
elif descendant.COLLECTION_TYPE == 'system':
autoinstall_data = self.api.autoinstallgen.generate_autoinstall_for_system(descendant.name)
- if distro.breed == "redhat":
+ if distro.breed == "redhat" or distro.breed == "generic_lower_os":
+ if distro.breed == "redhat" or dist.breed == "generic_lower_os":
cdregex = re.compile(r"^\s*url .*\n", re.IGNORECASE | re.MULTILINE)
autoinstall_data = cdregex.sub("cdrom\n", autoinstall_data, count=1)
diff --git a/cobbler/actions/check.py b/cobbler/actions/check.py
index 319c03f..9ae8831 100644
index 4fadab5..4893bf9 100644
--- a/cobbler/actions/check.py
+++ b/cobbler/actions/check.py
@@ -139,7 +139,7 @@ class CobblerCheck(object):
@@ -138,7 +138,7 @@ class CobblerCheck:
if notes != "":
notes = " (NOTE: %s)" % notes
rc = 0
return_code = 0
- if self.checked_family in ("redhat", "suse"):
+ if self.checked_family in ("redhat", "suse", "generic_lower_os"):
if os.path.exists("/etc/rc.d/init.d/%s" % which):
rc = utils.subprocess_call(self.logger, "/sbin/service %s status > /dev/null 2>/dev/null" % which, shell=True)
if rc != 0:
return_code = utils.subprocess_call(self.logger,
"/sbin/service %s status > /dev/null 2>/dev/null" % which,
diff --git a/cobbler/actions/reposync.py b/cobbler/actions/reposync.py
index fb2ac5c..6b4ff70 100644
index 651514f..ddee79c 100644
--- a/cobbler/actions/reposync.py
+++ b/cobbler/actions/reposync.py
@@ -275,7 +275,7 @@ class RepoSync(object):
mdoptions.append("-g %s" % groupmdfile)
if "prestodelta" in rd:
# need createrepo >= 0.9.7 to add deltas
- if utils.get_family() in ("redhat", "suse"):
@@ -257,7 +257,7 @@ class RepoSync:
mdoptions.append("-g %s" % os.path.join(origin_path, groupmdfile))
if "prestodelta" in rd:
# need createrepo >= 0.9.7 to add deltas
- if utils.get_family() in ("redhat", "suse"):
+ if utils.get_family() in ("redhat", "suse", "generic_lower_os"):
cmd = "/usr/bin/rpmquery --queryformat=%{VERSION} createrepo"
createrepo_ver = utils.subprocess_get(self.logger, cmd)
if not createrepo_ver[0:1].isdigit():
cmd = "/usr/bin/rpmquery --queryformat=%{VERSION} createrepo"
createrepo_ver = utils.subprocess_get(self.logger, cmd)
if not createrepo_ver[0:1].isdigit():
diff --git a/cobbler/autoinstallgen.py b/cobbler/autoinstallgen.py
index 2f38a40..ec1aac5 100644
index d8532ca..0486bf8 100644
--- a/cobbler/autoinstallgen.py
+++ b/cobbler/autoinstallgen.py
@@ -314,7 +314,7 @@ class AutoInstallationGen(object):
@@ -312,7 +312,7 @@ class AutoInstallationGen:
meta.update(autoinstall_meta)
# add package repositories metadata to autoinstall metavariables
@ -154,34 +154,36 @@ index 2f38a40..ec1aac5 100644
meta["yum_config_stanza"] = self.generate_config_stanza(obj, (system is None))
# FIXME: implement something similar to zypper (SUSE based distros) and apt (Debian based distros)
diff --git a/cobbler/tftpgen.py b/cobbler/tftpgen.py
index 5c5b1ef..bf0f347 100644
index 087d8c0..5e10636 100644
--- a/cobbler/tftpgen.py
+++ b/cobbler/tftpgen.py
@@ -727,7 +727,7 @@ class TFTPGen(object):
else:
autoinstall_path = "http://%s/cblr/svc/op/autoinstall/profile/%s" % (httpserveraddress, profile.name)
@@ -746,7 +746,7 @@ class TFTPGen:
autoinstall_path = "http://%s/cblr/svc/op/autoinstall/profile/%s" \
% (httpserveraddress, profile.name)
- if distro.breed is None or distro.breed == "redhat":
+ if distro.breed is None or distro.breed == "redhat" or distro.breed == "generic_lower_os":
append_line += " kssendmac"
append_line = "%s ks=%s" % (append_line, autoinstall_path)
if distro.os_version in ["rhel4", "rhel5", "rhel6", "fedora16"]:
append_line += " kssendmac ks=%s" % autoinstall_path
diff --git a/cobbler/utils.py b/cobbler/utils.py
index 44a7016..8e46e47 100644
index 98663a5..7475a27 100644
--- a/cobbler/utils.py
+++ b/cobbler/utils.py
@@ -1056,6 +1056,9 @@ def os_release():
@@ -1017,8 +1017,10 @@ def os_release():
make = "suse"
if "suse" not in distro.like():
make = "unknown"
return make, float(distro_version)
- return make, float(distro_version)
+ return make, float(distro_versioni)
+ elif family == "generic_lower_os":
+ return "generic_lower_os", float(distro_version)
+
def is_safe_to_hardlink(src, dst, api):
def is_safe_to_hardlink(src: str, dst: str, api) -> bool:
"""
diff --git a/config/cobbler/distro_signatures.json b/config/cobbler/distro_signatures.json
index b1d073c..773e9f2 100644
index 6d2c04b..804f735 100644
--- a/config/cobbler/distro_signatures.json
+++ b/config/cobbler/distro_signatures.json
@@ -1,5 +1,33 @@
@ -219,7 +221,7 @@ index b1d073c..773e9f2 100644
"rhel4": {
"signatures": [
diff --git a/distro_build_configs.sh b/distro_build_configs.sh
index bad43e3..ef48836 100644
index 31ee5ce..19fc711 100644
--- a/distro_build_configs.sh
+++ b/distro_build_configs.sh
@@ -30,6 +30,9 @@ if [ "$DISTRO" = "" ] && [ -r /etc/os-release ];then
@ -232,17 +234,17 @@ index bad43e3..ef48836 100644
esac
fi
@@ -42,7 +45,7 @@ elif [ "$DISTRO" = "UBUNTU" ];then
export WEBROOT="/var/www";
export WEBCONFIG="/etc/apache2/conf-available";
@@ -43,7 +46,7 @@ elif [ "$DISTRO" = "UBUNTU" ];then
export WEBROOT="/var/www"
export WEBCONFIG="/etc/apache2/conf-available"
export DEFAULTPATH="etc/default"
-elif [ "$DISTRO" = "FEDORA" ];then
+elif [ "$DISTRO" = "FEDORA" ] || [ "$DISTRO" = `echo 'generic_os'|tr 'a-z' 'A-Z'` ];then
export APACHE_USER="apache"
export HTTP_USER=$APACHE_USER # overrule setup.py
export APACHE_GROUP="apache"
diff --git a/templates/etc/dhcp.template b/templates/etc/dhcp.template
index e450419..e8a2b91 100644
index a24f903..68ebe8a 100644
--- a/templates/etc/dhcp.template
+++ b/templates/etc/dhcp.template
@@ -33,7 +33,7 @@ subnet 192.168.1.0 netmask 255.255.255.0 {
@ -283,5 +285,5 @@ index e450419..e8a2b91 100644
# RiskV 32 bit
else if option system-arch = 00:25 {
--
2.30.0
2.43.0