openstack/tripleo-common
Code Issues Proposed changes

Ensure image files are readable to apache

Browse Source 
If the umask on undercloud is set as something like `077`, the image
files created with `sudo` will not be readable to `others` including
`apache`, which will cause 403 forbidden during image pulling on
overcloud.

So set the permission explicitly just like we already did for
`make_dir` function.

Change-Id: I0f44b21be981f230abdf9baee4eab747a9a46114
This commit is contained in:
Zhu Sheng Li 2020-08-11 17:10:23 +08:00
parent f43cacd38f
commit a6bbe52897
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tripleo_common/image/image_export.py
View File

@ -110,7 +110,9 @@ def export_stream(target_url, layer, layer_stream, verify_digest=True):
(image, blob_path)) (image, blob_path))
try: try:
with open(blob_path, 'wb') as f: fd = os.open(blob_path, os.O_WRONLY | os.O_CREAT)
os.fchmod(fd, 0o0644)
with open(fd, 'wb') as f:
count = 0 count = 0
for chunk in layer_stream: for chunk in layer_stream:
count += 1 count += 1

5
tripleo_common/tests/image/test_image_export.py
View File

@ -90,6 +90,7 @@ class TestImageExport(base.TestCase):
} }
calc_digest = hashlib.sha256() calc_digest = hashlib.sha256()
layer_stream = io.BytesIO(blob_compressed) layer_stream = io.BytesIO(blob_compressed)
mask = os.umask(0o077)
layer_digest, _ = image_export.export_stream( layer_digest, _ = image_export.export_stream(
target_url, layer, layer_stream, verify_digest=False target_url, layer, layer_stream, verify_digest=False
) )
@ -106,6 +107,10 @@ class TestImageExport(base.TestCase):
with open(blob_path, 'rb') as f: with open(blob_path, 'rb') as f:
self.assertEqual(blob_compressed, f.read()) self.assertEqual(blob_compressed, f.read())
os.umask(mask)
blob_mode = oct(os.stat(blob_path).st_mode)
self.assertEqual('644', blob_mode[-3:])
@mock.patch('tripleo_common.image.image_export.open', @mock.patch('tripleo_common.image.image_export.open',
side_effect=MemoryError()) side_effect=MemoryError())
def test_export_stream_memory_error(self, mock_open): def test_export_stream_memory_error(self, mock_open):