mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions

Fix a TOCTOU in remote harvest zipapp
Some checks failed
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Waiting to run
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Waiting to run
Details
Lint / test (push) Waiting to run
Details
CI / test (push) Has been cancelled
Details

Browse source 
Promote uploaded zipapps into a private root-owned directory before
verification and execution. Copy and hash through the same pinned file
descriptor, reject unsafe file types and metadata, publish atomically,
and ensure sudo executes only the verified root-owned copy.
This commit is contained in:
Miguel Jacq 2026-08-03 15:29:17 +10:00
parent 82db7a7d72
commit 1e9806d2dc
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
6 changed files with 831 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

4
rpm/enroll.spec
View file

@ -1,4 +1,4 @@
%global upstream_version 0.8.0
%global upstream_version 0.8.1
Name: enroll
Version: %{upstream_version}
@ -43,6 +43,8 @@ Enroll a server's running state retrospectively into Ansible.
%{_bindir}/enroll
%changelog
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: fix a TOCTOU in remote harvest.
* Mon Jul 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
- Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.