mirror of
https://github.com/openSUSE/osc.git
synced 2024-11-09 22:36:14 +01:00
Merge branch 'improve-mode-handling' of https://github.com/Firstyear/osc
Only change the mode of a config file if it is different from 0o600 (instead of unconditionally calling os.chmod). The advantage of the new behavior is that it also works with a read-only filesystem. Additionally, if the mode is not 0o600 and the config file resides on a read-only filesystem, we print a warning and continue (actually, this change is debatable but it is also not too bad because the config file does not necessarily have to contain the passwords anymore... (let's keep our fingers crossed that no 3rd party application relied on the "implicit" os.chmod API, though)).
This commit is contained in:
commit
3ba867cf94
11
osc/conf.py
11
osc/conf.py
@ -38,6 +38,7 @@ The configuration dictionary could look like this:
|
||||
|
||||
import bz2
|
||||
import base64
|
||||
import errno
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
@ -896,7 +897,15 @@ def get_config(override_conffile=None,
|
||||
# okay, we made sure that oscrc exists
|
||||
|
||||
# make sure it is not world readable, it may contain a password.
|
||||
os.chmod(conffile, 0o600)
|
||||
conffile_stat = os.stat(conffile)
|
||||
if conffile_stat.st_mode != 0o600:
|
||||
try:
|
||||
os.chmod(conffile, 0o600)
|
||||
except OSError as e:
|
||||
if e.errno == errno.EROFS:
|
||||
print('Warning: file \'%s\' may have an insecure mode.', conffile)
|
||||
else:
|
||||
raise e
|
||||
|
||||
cp = get_configParser(conffile)
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user