openstack
/
oslo.rootwrap
Code Issues Proposed changes

CommandFilter should compare basename from both sides 

Otherwise we're comparing basename with fullpath when fullpath is the
command argument.

Closes-Bug:: #1956606

Change-Id: I76094065de5b37f59a2500fbce7f500ada9915da
This commit is contained in:
David Vallee Delisle 2022-01-05 12:36:04 -05:00
parent 25fcff997b
commit 7e1cd98f08
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
oslo_rootwrap/filters.py
View File

@ -74,7 +74,9 @@ class CommandFilter(object):
def match(self, userargs):
"""Only check that the first argument (command) matches exec_path."""
return userargs and os.path.basename(self.exec_path) == userargs[0]
exec_path = os.path.basename(self.exec_path)
user_path = os.path.basename(userargs[0]) if userargs else False
return userargs and exec_path == user_path
def preexec(self):
"""Setuid in subprocess right before command is invoked."""

4
oslo_rootwrap/tests/test_functional.py
View File

@ -77,6 +77,10 @@ later_install_cmd: CommandFilter, %s, root
self.assertEqual(expect_out, out)
self.assertEqual(expect_err, err)
def _test_run_with_path(self, expect_byte=True):
code, out, err = self.execute(['/bin/echo', 'teststr'])
self.assertEqual(0, code)
def _test_run_with_stdin(self, expect_byte=True):
code, out, err = self.execute(['cat'], stdin=b'teststr')
self.assertEqual(0, code)