Skip to content

Commit 1db260f

Browse files
Fix: proper permissions for systemvm template registrations on hardened systems
Related to #10029 (comment) We have umask 0077, so cloud-install-sys-tmplt is creating by default paths like below ``` $ ls -l /mnt/secondary/template/tmpl/ total 16 drwx------. 3 root root 4096 Nov 19 13:58 1 drwxrwxrwx. 7 root root 4096 Oct 31 09:42 2 drwxrwxrwx. 3 root root 4096 Oct 30 15:59 4 drwxr-xr-x. 2 root root 4096 Oct 31 10:21 5 $ ls -l /mnt/secondary/template/tmpl/1/ total 4 drwx------. 2 root root 4096 Nov 19 13:59 3 $ ls -l /mnt/secondary/template/tmpl/1/3/ total 549848 -rw-------. 1 root root 563032576 Nov 19 13:59 d23a1e19-c563-4f69-85ca-8721cf02082c.qcow2 -rw-------. 1 root root 287 Nov 19 13:59 template.properties ``` This results to the permissions problems later on, when trying to access the image Signed-off-by: Artem Sidorenko <[email protected]>
1 parent 028dd86 commit 1db260f

File tree

2 files changed

+2
-0
lines changed

2 files changed

+2
-0
lines changed

scripts/storage/secondary/cloud-install-sys-tmplt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ failed() {
4444
}
4545

4646
#set -x
47+
umask 0022 # ensure we have the proper permissions even on hardened deployments
4748
mflag=
4849
fflag=
4950
ext="vhd"

scripts/storage/secondary/setup-sysvm-tmplt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919

2020
# Usage: e.g. failed $? "this is an error"
2121
set -x
22+
umask 0022 # ensure we have the proper permissions even on hardened deployments
2223

2324
failed() {
2425
local returnval=$1

0 commit comments

Comments
 (0)