fix CVE-2020-14019

0001-saveconfig-copy-temp-configfile-with-permissions.patch

@@ -0,0 +1,53 @@
+From b23d061ee0fa7924d2cdce6194c313b9ee06c468 Mon Sep 17 00:00:00 2001
+From: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
+Date: Thu, 28 May 2020 20:42:16 +0530
+Subject: [PATCH] saveconfig: copy temp configfile with permissions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+shutil.copyfile() will not copy permissions, so all the perms that we
+set on tempfile will go for a toss, and will be reset to default
+
+┌──────────────────┬────────┬───────────┬───────┬────────────────┐
+│     Function     │ Copies │   Copies  │Can use│   Destination  │
+│                  │metadata│permissions│buffer │may be directory│
+├──────────────────┼────────┼───────────┼───────┼────────────────┤
+│shutil.copy       │   No   │    Yes    │   No  │      Yes       │
+│shutil.copyfile   │   No   │     No    │   No  │       No       │
+│shutil.copy2      │  Yes   │    Yes    │   No  │      Yes       │
+│shutil.copyfileobj│   No   │     No    │  Yes  │       No       │
+└──────────────────┴────────┴───────────┴───────┴────────────────┘
+
+Without this fix:
+----------------
+$ ls /etc/target/saveconfig.json -l
+-rw-r--r-- 1 root root 5078 May 28 20:01 /etc/target/saveconfig.json
+
+With this fix:
+--------------
+$ ls /etc/target/saveconfig.json -l
+-rw------- 1 root root 5078 May 28 20:15 /etc/target/saveconfig.json
+
+Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
+---
+ rtslib/root.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/rtslib/root.py b/rtslib/root.py
+index a101edd..7364154 100644
+--- a/rtslib/root.py
++++ b/rtslib/root.py
+@@ -486,7 +486,8 @@ class RTSRoot(CFSNode):
+             os.fsync(f.fileno())
+             f.close()
+ 
+-        shutil.copyfile(tmp_file, save_file)
++        # copy along with permissions
++        shutil.copy(tmp_file, save_file)
+         os.remove(tmp_file)
+ 
+     def restore_from_file(self, restore_file=None, clear_existing=True,
+-- 
+1.8.3.1
+

0002-saveconfig-open-the-temp-configfile-with-modes-set.patch

@@ -0,0 +1,46 @@
+From dffcf83bead64e959505d64ad587768647caab3a Mon Sep 17 00:00:00 2001
+From: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
+Date: Thu, 28 May 2020 19:53:04 +0530
+Subject: [PATCH] saveconfig: open the temp configfile with modes set
+
+Fixes: #161
+Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
+---
+ rtslib/root.py | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/rtslib/root.py b/rtslib/root.py
+index afe1a53..a101edd 100644
+--- a/rtslib/root.py
++++ b/rtslib/root.py
+@@ -461,8 +461,25 @@ class RTSRoot(CFSNode):
+ 
+         tmp_file = save_file + ".temp"
+ 
+-        with open(tmp_file, "w+") as f:
+-            os.fchmod(f.fileno(), stat.S_IRUSR | stat.S_IWUSR)
++        mode = stat.S_IRUSR | stat.S_IWUSR  # 0o600
++        umask = 0o777 ^ mode  # Prevents always downgrading umask to 0
++
++        # For security, remove file with potentially elevated mode
++        try:
++            os.remove(tmp_file)
++        except OSError:
++            pass
++
++        umask_original = os.umask(umask)
++        # Even though the old file is first deleted, a race condition is still
++        # possible. Including os.O_EXCL with os.O_CREAT in the flags will
++        # prevent the file from being created if it exists due to a race
++        try:
++            fdesc = os.open(tmp_file, os.O_WRONLY | os.O_CREAT | os.O_EXCL, mode)
++        finally:
++            os.umask(umask_original)
++
++        with os.fdopen(fdesc, 'w+') as f:
+             f.write(json.dumps(saveconf, sort_keys=True, indent=2))
+             f.write("\n")
+             f.flush()
+-- 
+1.8.3.1
+

python-rtslib.spec

@@ -5,12 +5,14 @@
 
 Name: python-rtslib
 Version: 2.1.70
-Release: 4
+Release: 5
 Summary: Python object API for Linux kernel LIO SCSI target
 
 License: ASL 2.0
 URL: https://github.com/open-iscsi/%{oname}
 Source0: %{url}/archive/v%{version}/%{oname}-%{version}.tar.gz
+Patch1: 0001-saveconfig-copy-temp-configfile-with-permissions.patch
+Patch2: 0002-saveconfig-open-the-temp-configfile-with-modes-set.patch
 
 BuildArch: noarch
 BuildRequires: epydoc, systemd-units
@@ -158,6 +160,9 @@ install -m 644 doc/saveconfig.json.5.gz %{buildroot}%{_mandir}/man5/
 %{_mandir}/man5/saveconfig.json.5.gz
 
 %changelog
+* Fri Jul 17 2020 Ruijun Ge <geruijun@huawei.com> - 2.1.70-5
+- fix CVE-2020-14019
+
 * Sun Jul 5 2020 Zhiqiang Liu <lzhq28@mail.ustc.edu.cn> - 2.1.70-4
 - remove useless readme files.