diff options
| author | Jakub Neumann <jneumann@cloudferro.com> | 2022-11-24 10:29:47 +0100 |
|---|---|---|
| committer | Maksim Malchuk <maksim.malchuk@gmail.com> | 2022-11-30 18:00:12 +0000 |
| commit | 6be0068f376b0ae67bc81b50a97e042a88317d28 (patch) | |
| tree | 8a5023406f99a3bec2e91e87c190b7dd8d8e5f0c | |
| parent | c6012bde6ca0e50927699b47fbdb737845ee49ed (diff) | |
| download | kolla-6be0068f376b0ae67bc81b50a97e042a88317d28.tar.gz kolla-6be0068f376b0ae67bc81b50a97e042a88317d28.zip | |
Fix plugin builds with sources using type=git
A recent change to git [1] introduced a new behaviour to work around a
CVE [2] that disallows any git operations in directories not owned by
the current user.
A fix was introduced for general checkouts, but it was not applied
to the plugins archive, resulting in PBR still not working as intended.
[1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765.
Closes-Bug: #1969096
Related-Bug: #1968877
Co-Authored-By: Mark Goddard <mark@stackhpc.com>
Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz+kolla@linaro.org>
Signed-off-by: Jakub Neumann <jneumann@cloudferro.com>
Change-Id: Ib3a37eebb29d975fc51a117cecdff74baafd8941
| -rw-r--r-- | kolla/image/tasks.py | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/kolla/image/tasks.py b/kolla/image/tasks.py index cbfecce09..bfc01dec5 100644 --- a/kolla/image/tasks.py +++ b/kolla/image/tasks.py @@ -293,8 +293,18 @@ class BuildTask(DockerTask): image.status = Status.CONNECTION_ERROR raise ArchivingError arc_path = os.path.join(image.path, '%s-archive' % arcname) + + # NOTE(jneumann): Change ownership of files to root:root. This + # avoids an issue introduced by the fix for git CVE-2022-24765, + # which breaks PBR when the source checkout is not owned by the + # user installing it. LP#1969096 + def reset_userinfo(tarinfo): + tarinfo.uid = tarinfo.gid = 0 + tarinfo.uname = tarinfo.gname = "root" + return tarinfo + with tarfile.open(arc_path, 'w') as tar: - tar.add(items_path, arcname=arcname) + tar.add(items_path, arcname=arcname, filter=reset_userinfo) return len(os.listdir(items_path)) self.logger.debug('Processing') |