Project

Profile

Help

Issue #3498

gpg_cmd configuration option should not be accepted in repo config or overrides

Added by mihai.ibanescu@gmail.com over 3 years ago. Updated over 2 years ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version - Debian:
Platform Release:
2.16.4
Target Release - Debian:
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

As a user, I can specify a gpg_cmd option in the plugin's distributor config, which will override the plugin config.

This has security implications, since it allows a potentially malicious user to execute commands remotely on the pulp server as user apache.

The fix is not entirely straightforward. I think one would want a per-config-type allowed options.


Related issues

Copied from RPM Support - Issue #3474: gpg_cmd configuration option should not be accepted in repo config or overridesCLOSED - CURRENTRELEASE<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>

Associated revisions

Revision 1c51268d View on GitHub
Added by Mihai Ibanescu over 3 years ago

gpg_cmd is not allowed as plugin or override configuration

Since the command configured with gpg_cmd executes remotely as user apache, a user should not be allowed to change it via a distributor config or an override at publish time.

Fixes #3498 https://pulp.plan.io/issues/3498

Change-Id: I88cdb4f51c237b1157e7424863df7049269939ca

Revision f86d8a88 View on GitHub
Added by Mihai Ibanescu over 3 years ago

gpg_cmd is not allowed as plugin or override configuration

Since the command configured with gpg_cmd executes remotely as user apache, a user should not be allowed to change it via a distributor config or an override at publish time.

Fixes #3498 https://pulp.plan.io/issues/3498

Change-Id: I88cdb4f51c237b1157e7424863df7049269939ca (cherry picked from commit 1c51268d91fbaee1e74bb9b842523d43ac13dd24)

History

#1 Updated by mihai.ibanescu@gmail.com over 3 years ago

  • Copied from Issue #3474: gpg_cmd configuration option should not be accepted in repo config or overrides added

#4 Updated by Anonymous over 3 years ago

  • Status changed from NEW to MODIFIED

#5 Updated by daviddavis over 3 years ago

  • Platform Release set to 2.16.4

#6 Updated by Anonymous over 3 years ago

#7 Updated by daviddavis over 3 years ago

  • Status changed from MODIFIED to 5

#8 Updated by daviddavis over 3 years ago

  • Status changed from 5 to CLOSED - CURRENTRELEASE

#9 Updated by bmbouter over 2 years ago

  • Tags Pulp 2 added

Please register to edit this issue

Also available in: Atom PDF