Fix config permissions on the config directory and the config file #4173

blag · 2018-06-11T22:16:39Z

This ensures that we create the config directory and file with the proper permissions.

It also tweaks the st2 login command to check the permissions on the config file (~/.st2/config) and directory (~/.st2) every time it is run, and then automatically fix permissions if they are too permissive. It does use the warnings module to warn the user about this, but does not give them a chance to opt out or turn the behavior off.

Automatically fixing the directory/file permissions assumes that there is no good reason for a process owned by another user or group to need read access to the config file. That is a very large assumption, so I'm inviting discussion about that.

The options are:

simply "warn the user" into fixing the config permissions, but not automatically fix it ourselves
use environment variables or command line flags to control warnings and automatic fixing behavior
warn the user and automatically fix it ourselves all the time
fix it automatically without warning

I have chosen option 3 here.

arm4b · 2018-06-11T22:51:01Z

st2client/st2client/base.py

        """
        if not os.path.isdir(ST2_CONFIG_DIRECTORY):
-            os.makedirs(ST2_CONFIG_DIRECTORY)
+            os.makedirs(ST2_CONFIG_DIRECTORY, mode=0o770)


Can we also set setgid for the config dir? 2770,

see #4144 and StackStorm/packer-st2#38 why

Yes, I'll do this.

~~I assume we also want the setuid bit set, right? 0o6770?~~

Edit: Nope, nevermind: https://en.wikipedia.org/wiki/Setuid#When_set_on_a_directory

I don't have any opinions about the setuid, since I didn't see that bit having effect on dir.
If you believe it can help in some use cases, - I'm good with adding it.

Nope, I don't think it's helpful.

Fixed.

arm4b · 2018-06-11T22:55:30Z

My vote goes in favor of:

simply "warn the user" into fixing the config permissions, but not automatically fix it ourselves

Create config dir and files with safe permissions and don't try to change them after that.

Curious what others think.

arm4b · 2018-06-11T22:57:57Z

To fix the entire story, need also to take care about the StackStorm/st2-packages#558 (StackStorm/st2-packages#520 might help with it)

Kami · 2018-06-12T08:58:39Z

I agree with @armab, I also think 1) is better (user might have a (valid) use case to change the permissions after the fact and we probably shouldn't mess with the permissions after the initial set up, but should definitely warn in case of unsafe permissions).

Kami · 2018-06-13T09:55:16Z

st2client/st2client/config_parser.py

+        config_dir_path = os.path.dirname(self.config_file_path)
+
+        if bool(os.stat(config_dir_path).st_mode ^ 0o770):
+            warnings.warn('Setting StackStorm config directory permissions '


Instead of using warnings module we should probably use logger.warn since we also use logging in other places for such things.

This way it uses the existing framework and setting log level, etc works as expected (e.g. user wants to suppress warnings and only see messages with level ERROR and above).

Kami · 2018-06-15T09:12:40Z

Can you please add a changelog entry?

Besides that, LGTM 👍

arm4b · 2018-06-15T09:54:34Z

st2client/st2client/config_parser.py

+            self.LOG.warn(
+                # TODO: Perfect place for an f-string
+                "The StackStorm configuration directory permissions are "
+                "insecure (SGID bit not set)."


I don't think it's a best to warn user about the absence of SGID bit.
It's a workaround that'll help creating file names with the same group under the config dir, but not really that much security-related.

Besides of that minor comment, looks good to me too 👍

arm4b · 2018-06-15T09:57:21Z

st2client/st2client/base.py

        """
        if not os.path.isdir(ST2_CONFIG_DIRECTORY):
-            os.makedirs(ST2_CONFIG_DIRECTORY)
+            os.makedirs(ST2_CONFIG_DIRECTORY, mode=0o770)


Just a reminder to not forget to set setguid bit before merging. Can't find it anywhere, except of tests.

Fixed, please re-review when you have time.

arm4b · 2018-06-20T15:48:43Z

st2client/st2client/base.py

+            os.makedirs(ST2_CONFIG_DIRECTORY, mode=0o2770)
+            # os.makedirs straight up ignores the setgid bit, so we have to set
+            # it manually
+            os.chmod(ST2_CONFIG_DIRECTORY, 0o2770)


Makes sense in dir conext 👍

arm4b · 2018-06-20T15:48:50Z

st2client/st2client/base.py

+        fd = os.open(cached_token_path, os.O_WRONLY | os.O_CREAT, 0o660)
        with os.fdopen(fd, 'w') as fp:
            fp.write(data)
+        os.chmod(cached_token_path, 0o660)


Wouldn't this always try to chmod cached token file?
I think we previously agreed to do chmod operations only on initial file creation.

Yes it would, but as far as I can tell, it's only run when the file is initially created.

Alright, thanks for explaining 👍

arm4b · 2018-06-20T15:49:59Z

st2client/st2client/commands/auth.py


        with open(config_file, 'w') as cfg_file_out:
            config.write(cfg_file_out)
+        os.chmod(config_file, mode=0o660)


Same here. I think we previously agreed to set file permissions only on creation and don't try chmod afterwards.

arm4b · 2018-06-20T16:42:10Z

st2client/st2client/config_parser.py

+                "\n\n"
+                "You can fix this by running:"
+                "\n\n"
+                "chmod g+s {config_dir}".format(config_dir=config_dir_path))


For the LOG.info message level, do you know/can you check where will it show while running st2 commands?

That depends ~~greatly on the configuration file itself~ on the --debug flag, but the info level is not output to stdout or stderr by default:

>>> import logging >>> logger = logging.getLogger("_") >>> logger.info("Hello World!") >>>

Thanks for verifying that 👍

arm4b · 2018-06-21T11:57:35Z

I tried the packages produced from this PR and got the following error:

vagrant@stackstorm:~$ st2 login -w st2admin
Password: 
Failed to log in as st2admin: chmod() takes no keyword arguments

arm4b · 2018-06-21T12:03:59Z

Also squashing all commits history in 1 during review makes it harder to follow the history, code diff from the most recent look and overall commenting.
If you prefer, - it's still possible to do squash during the merge as a last step.

Kami · 2018-06-21T14:23:58Z

Can we get this resolved / finished today and merged in time for v2.8.0?

…e config file

arm4b · 2018-06-22T17:51:00Z

st2client/st2client/config_parser.py

+                "\n\n"
+                "You can fix this by running:"
+                "\n\n"
+                "chmod 770 {config_dir}".format(config_dir=config_dir_path))


I can confirm that previous commit fixes st2client.config_parser issue.

There is a new edge case, warning messages are duplicated:

$ st2 action list 2018-06-22 17:41:48,953 WARNING - The StackStorm configuration directory permissions are insecure (too permissive). You can fix this by running: chmod 770 /home/vagrant/.st2 2018-06-22 17:41:48,954 WARNING - The StackStorm configuration file permissions are insecure. You can fix this by running: chmod 660 /home/vagrant/.st2/config 2018-06-22 17:41:48,955 WARNING - The StackStorm configuration directory permissions are insecure (too permissive). You can fix this by running: chmod 770 /home/vagrant/.st2 2018-06-22 17:41:48,957 WARNING - The StackStorm configuration file permissions are insecure. You can fix this by running: chmod 660 /home/vagrant/.st2/config 2018-06-22 17:41:48,959 WARNING - Permissions (0664) for cached token file "/home/vagrant/.st2/token-st2admin" are to permissive. Please restrict the permissions and make sure only your own user can read from the file

To reproduce:

chmod -R o+r ~/.st2 st2 action list

arm4b · 2018-06-26T14:42:41Z

CHANGELOG.rst

 ~~~~~~~

+* Update st2 CLI to create the configuration directory and file, and authentication tokens with
+  secure permissions (eg: readable only to owner)


NIT: To include the PR #number in the CHANGELOG.

arm4b · 2018-06-26T14:55:02Z

st2client/st2client/base.py

-                       'from the file' % (file_st_mode, cached_token_path))
-            self.LOG.warn(message)
+                       'from or write to the file.'
+                       '\n\n'


NIT: I think that's too many new lines here which makes it pretty inconsistent with existing stackstorm warning messages by taking a lot of space. Example:

vagrant@stackstorm:~$ st2 action list 2018-06-26 14:50:42,463 WARNING - The StackStorm configuration directory permissions are insecure (too permissive). You can fix this by running: chmod 770 /home/vagrant/.st2 2018-06-26 14:50:42,463 WARNING - The StackStorm configuration file permissions are insecure. You can fix this by running: chmod 660 /home/vagrant/.st2/config 2018-06-26 14:50:42,463 WARNING - Permissions (0664) for cached token file "/home/vagrant/.st2/token-st2admin" are too permissive. Please restrict the permissions and make sure only your own user can read from or write to the file. You can fix this by running: chmod o-rw /home/vagrant/.st2/token-st2admin

Small nitpick - In some places in the log messages we use numerical permission levels and in other we use symbolic notation.

It's probably a good idea to unify it and use numerical / symbolic everywhere :)

I'll simply remove the help text. I just usually like to give users some idea of how to fix a problem, which requires readable formatting, but it might not be the best for log messages.

The octal vs symbolic issue is more than just a notation difference, it's a functional one. The octal notation sets the permissions for the user, group, and "others", but the symbolic notation here performs operations on the permissions for just "others" and leaves the bits for the user and group intact.

arm4b

Thanks for fixing all the corner cases. LGTM now 👍

Just left a couple of very minor non-blocking comments, if you'd prefer to further improve it for consistency.

Kami · 2018-06-26T18:29:12Z

Probably a good idea to get this merged today so we can include it in v2.8.0.

Those non-blockers mentioned above can be fixed / improved later.

blag · 2018-06-29T16:50:16Z

Warnings and tests are turned off in #4215 (41769824b51aa19edb786a9e7e4b7f91b16f65d7 and e16a59ac029926f63fa1eb507653f19fef18f4c7).

arm4b reviewed Jun 11, 2018

View reviewed changes

Kami added this to the 2.8.0 milestone Jun 12, 2018

blag force-pushed the warn-and-fix-config-file-permissions branch 2 times, most recently from 92e8f5a to 591e608 Compare June 12, 2018 18:30

Kami reviewed Jun 13, 2018

View reviewed changes

blag force-pushed the warn-and-fix-config-file-permissions branch 4 times, most recently from 33705c1 to c3a65ae Compare June 14, 2018 21:14

blag mentioned this pull request Jun 14, 2018

Fix configuration directory and file permissions StackStorm/st2-packages#563

Open

blag force-pushed the warn-and-fix-config-file-permissions branch from c3a65ae to 5479226 Compare June 15, 2018 00:13

Kami approved these changes Jun 15, 2018

View reviewed changes

arm4b reviewed Jun 15, 2018

View reviewed changes

arm4b suggested changes Jun 15, 2018

View reviewed changes

blag force-pushed the warn-and-fix-config-file-permissions branch 2 times, most recently from 528d61d to fbebae3 Compare June 20, 2018 15:23

arm4b reviewed Jun 20, 2018

View reviewed changes

blag force-pushed the warn-and-fix-config-file-permissions branch from fbebae3 to 1bce27b Compare June 20, 2018 17:38

blag force-pushed the warn-and-fix-config-file-permissions branch from 1bce27b to 6dfc81c Compare June 21, 2018 18:30

Warn about insecure config permissions on the config directory and th…

7b2272f

…e config file

arm4b suggested changes Jun 22, 2018

View reviewed changes

blag force-pushed the warn-and-fix-config-file-permissions branch 8 times, most recently from 98cb224 to caa90ff Compare June 26, 2018 07:48

Tweak log configuration logic to silence messages

fd5d3cf

blag force-pushed the warn-and-fix-config-file-permissions branch from a23403f to fd5d3cf Compare June 26, 2018 08:23

blag and others added 3 commits June 26, 2018 03:04

Test new log configuration logic

a88528e

Merge branch 'master' into warn-and-fix-config-file-permissions

ba571ab

Merge branch 'master' into warn-and-fix-config-file-permissions

1ad3a9e

arm4b reviewed Jun 26, 2018

View reviewed changes

arm4b approved these changes Jun 26, 2018

View reviewed changes

Merge branch 'master' into warn-and-fix-config-file-permissions

dc8b3ad

m4dcoder self-requested a review June 26, 2018 18:43

blag and others added 7 commits June 26, 2018 12:14

Remove help text from log messages

9b54e09

Add PR number to changelog

d20def7

Merge branch 'master' into warn-and-fix-config-file-permissions

34b48c4

Remove one last help text from log messages

1ccd649

Tweak to not warn on weird permissions

2680dce

Add tests for weird permissions and refactor tests

1c76e6b

Merge branch 'master' into warn-and-fix-config-file-permissions

d563628

blag merged commit 20fd6c0 into master Jun 27, 2018

arm4b deleted the warn-and-fix-config-file-permissions branch June 28, 2018 11:14

Uh oh!

Fix config permissions on the config directory and the config file #4173

Fix config permissions on the config directory and the config file #4173

Uh oh!

Conversation

blag commented Jun 11, 2018

Uh oh!

arm4b Jun 11, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blag Jun 13, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arm4b commented Jun 11, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arm4b commented Jun 11, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Kami commented Jun 12, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Kami commented Jun 15, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arm4b Jun 15, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blag Jun 21, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arm4b commented Jun 21, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arm4b commented Jun 21, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Kami commented Jun 21, 2018

Uh oh!

arm4b Jun 22, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arm4b Jun 26, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arm4b left a comment

arm4b Jun 11, 2018 •

edited

Loading

blag Jun 13, 2018 •

edited

Loading

arm4b commented Jun 11, 2018 •

edited

Loading

arm4b commented Jun 11, 2018 •

edited

Loading

arm4b Jun 15, 2018 •

edited

Loading

blag Jun 21, 2018 •

edited

Loading

arm4b commented Jun 21, 2018 •

edited

Loading

arm4b commented Jun 21, 2018 •

edited

Loading

arm4b Jun 22, 2018 •

edited

Loading

arm4b Jun 26, 2018 •

edited

Loading