Actions
Issue #3498
closed
gpg_cmd configuration option should not be accepted in repo config or overrides
Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version - Debian:
Platform Release:
2.16.4
Target Release - Debian:
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:
Description
As a user, I can specify a gpg_cmd option in the plugin's distributor config, which will override the plugin config.
This has security implications, since it allows a potentially malicious user to execute commands remotely on the pulp server as user apache.
The fix is not entirely straightforward. I think one would want a per-config-type allowed options.
Related issues
Actions
.
gpg_cmd is not allowed as plugin or override configuration
Since the command configured with gpg_cmd executes remotely as user apache, a user should not be allowed to change it via a distributor config or an override at publish time.
Fixes #3498 https://pulp.plan.io/issues/3498
Change-Id: I88cdb4f51c237b1157e7424863df7049269939ca