openstack/python-keystoneclient
Code Issues Proposed changes

Securely create signing_dir (bug 1174608)

Browse Source 
Also verifies the security of an existing signing_dir.

Change-Id: I0685b4274a94ad3974a2b2a7ab3f45830d3934bb
This commit is contained in:
Dolph Mathews
2013-05-08 10:49:20 -05:00
parent 8f80678677
commit 1736e2ffb1
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
keystoneclient/middleware/auth_token.py
View File

@@ -296,15 +296,20 @@ class AuthProtocol(object):
self.signing_dirname = self._conf_get('signing_dir') self.signing_dirname = self._conf_get('signing_dir')
self.LOG.info('Using %s as cache directory for signing certificate' % self.LOG.info('Using %s as cache directory for signing certificate' %
self.signing_dirname) self.signing_dirname)
if (os.path.exists(self.signing_dirname) and if os.path.exists(self.signing_dirname):
not os.access(self.signing_dirname, os.W_OK)): if not os.access(self.signing_dirname, os.W_OK):
raise ConfigurationError("unable to access signing dir %s" % raise ConfigurationError(
self.signing_dirname) 'unable to access signing_dir %s' % self.signing_dirname)
if os.stat(self.signing_dirname).st_uid != os.getuid():
if not os.path.exists(self.signing_dirname): self.LOG.warning(
os.makedirs(self.signing_dirname) 'signing_dir is not owned by %s' % os.getlogin())
#will throw IOError if it cannot change permissions current_mode = stat.S_IMODE(os.stat(self.signing_dirname).st_mode)
os.chmod(self.signing_dirname, stat.S_IRWXU) if current_mode != stat.S_IRWXU:
self.LOG.warning(
'signing_dir mode is %s instead of %s' %
(oct(current_mode), oct(stat.S_IRWXU)))
else:
os.makedirs(self.signing_dirname, stat.S_IRWXU)
val = '%s/signing_cert.pem' % self.signing_dirname val = '%s/signing_cert.pem' % self.signing_dirname
self.signing_cert_file_name = val self.signing_cert_file_name = val