ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-07-27 15:11:23 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Make sure umask is set restrictively before creating any vault files

Browse source
This commit is contained in:
James Cammarata 2014-04-18 11:40:20 -05:00
commit 75e0b7a5cf
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/ansible/utils/vault.py
View file

@ -191,12 +191,14 @@ class VaultEditor(object):
raise errors.AnsibleError("%s exists, please use 'edit' instead" % self.filename) raise errors.AnsibleError("%s exists, please use 'edit' instead" % self.filename)
# drop the user into vim on file # drop the user into vim on file
old_umask = os.umask(0077)
call(self._editor_shell_command(self.filename)) call(self._editor_shell_command(self.filename))
tmpdata = self.read_data(self.filename) tmpdata = self.read_data(self.filename)
this_vault = VaultLib(self.password) this_vault = VaultLib(self.password)
this_vault.cipher_name = self.cipher_name this_vault.cipher_name = self.cipher_name
enc_data = this_vault.encrypt(tmpdata) enc_data = this_vault.encrypt(tmpdata)
self.write_data(enc_data, self.filename) self.write_data(enc_data, self.filename)
os.umask(old_umask)
def decrypt_file(self): def decrypt_file(self):
@ -222,6 +224,9 @@ class VaultEditor(object):
if not HAS_AES or not HAS_COUNTER or not HAS_PBKDF2 or not HAS_HASH: if not HAS_AES or not HAS_COUNTER or not HAS_PBKDF2 or not HAS_HASH:
raise errors.AnsibleError(CRYPTO_UPGRADE) raise errors.AnsibleError(CRYPTO_UPGRADE)
# make sure the umask is set to a sane value
old_mask = os.umask(0077)
# decrypt to tmpfile # decrypt to tmpfile
tmpdata = self.read_data(self.filename) tmpdata = self.read_data(self.filename)
this_vault = VaultLib(self.password) this_vault = VaultLib(self.password)
@ -246,6 +251,9 @@ class VaultEditor(object):
# shuffle tmp file into place # shuffle tmp file into place
self.shuffle_files(tmp_path, self.filename) self.shuffle_files(tmp_path, self.filename)
# and restore the old umask
os.umask(old_mask)
def encrypt_file(self): def encrypt_file(self):
if not HAS_AES or not HAS_COUNTER or not HAS_PBKDF2 or not HAS_HASH: if not HAS_AES or not HAS_COUNTER or not HAS_PBKDF2 or not HAS_HASH: