livecd May 2013

livecd@lists.fedoraproject.org

8 participants
16 discussions

tools/livecd-iso-to-disk.sh
by Brian C. Lane 31 May '13

31 May '13

tools/livecd-iso-to-disk.sh | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) New commits: commit 1612a5bf3f7683246df07a81081afe180636156a Author: Brian C. Lane <bcl(a)redhat.com> Date: Fri May 31 10:22:50 2013 -0700 Replace bash string parsing with awk (#962039) du in F19 adds a - at the end now, confusing the parsing. Replaced it and a couple other instances with awk so that it is more clear what is happening. diff --git a/tools/livecd-iso-to-disk.sh b/tools/livecd-iso-to-disk.sh index eb7c3cc..23612ea 100755 --- a/tools/livecd-iso-to-disk.sh +++ b/tools/livecd-iso-to-disk.sh @@ -941,8 +941,8 @@ if [[ live == $srctype ]]; then targets="$TGTMNT/$SYSLINUXPATH" [[ -n $efi ]] && targets+=" $TGTMNT$EFI_BOOT" [[ -n $xo ]] && targets+=" $TGTMNT/boot/olpc.fth" - duTable=($(du -c -B 1M $targets 2> /dev/null || :)) - tbd=$((tbd + ${duTable[*]: -2:1})) + target_size=$(du -s -c -B 1M $targets 2> /dev/null | awk '/total$/ {print $1;}') || : + tbd=$((tbd + target_size)) fi if [[ -n $skipcompress ]] && [[ -s $SRCMNT/LiveOS/squashfs.img ]]; then @@ -973,12 +973,11 @@ if [[ live == $srctype ]]; then sources+=" $SRCMNT/isolinux $SRCMNT/syslinux" [[ -n $efi ]] && sources+=" $SRCMNT$EFI_BOOT" [[ -n $xo ]] && sources+=" $SRCMNT/boot/olpc.fth" - duTable=($(du -c -B 1M "$thisScriptpath" $sources 2> /dev/null || :)) - livesize=$((livesize + ${duTable[*]: -2:1})) + source_size=$(du -s -c -B 1M "$thisScriptpath" $sources 2> /dev/null | awk '/total$/ {print $1;}') || : + livesize=$((livesize + source_size)) fi -freespace=($(df -B 1M --total $TGTDEV)) -freespace=${freespace[*]: -2:1} +freespace=$(df -B 1M --total $TGTDEV | awk '/^total/ {print $4;}') if [[ live == $srctype ]]; then tba=$((overlaysizemb + homesizemb + livesize + swapsizemb))

2 1

Bug when LANG!=C
by Olivier Samyn 30 May '13

30 May '13

Hello, I tried to create an efi bootable usb stick using livecd-iso-to-disk with the following command: livecd-iso-to-disk --efi --format fedora.iso /dev/sdd I got got an error saying: "EFI boot requires a GPT partition table." "This can be done manually or you can run with --format" As I was running with the format option it seemed a little bit strange. I seems that parted called with the "p" command only works for english locale (maybe a bug in parted); but it works when the full command name is used "print" in this case. So, I simply patched livecd-iso-to-disk to use the full parted command name; see attached patch. Olivier Samyn.

1 0

imgcreate/kickstart.py
by Brian C. Lane 29 May '13

29 May '13

imgcreate/kickstart.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) New commits: commit cbcdff5b57ceb0f3f08fdc407585d88c850c1c2d Author: Brian C. Lane <bcl(a)redhat.com> Date: Wed May 29 14:02:57 2013 -0700 Fix default.target symlink (#968272) diff --git a/imgcreate/kickstart.py b/imgcreate/kickstart.py index 1ed9f2f..1d01ba5 100644 --- a/imgcreate/kickstart.py +++ b/imgcreate/kickstart.py @@ -255,7 +255,7 @@ class XConfig(KickstartConfig): default_target = self.path('/etc/systemd/system/default.target') if os.path.islink(default_target): os.unlink(default_target) - os.symlink(self.path('/lib/systemd/system/graphical.target'), default_target) + os.symlink('/lib/systemd/system/graphical.target', default_target) class RPMMacroConfig(KickstartConfig): """A class to apply the specified rpm macros to the filesystem"""

1 0

Branch 'rhel6-branch' - imgcreate/live.py
by Brian C. Lane 24 May '13

24 May '13

imgcreate/live.py | 1 + 1 file changed, 1 insertion(+) New commits: commit 1c7cc7edd3bbc77ad57ca2cea32d4a3d6870722e Author: Brian C. Lane <bcl(a)redhat.com> Date: Fri May 24 12:03:55 2013 -0700 Add dmsquash-live module to dracut (#957892) diff --git a/imgcreate/live.py b/imgcreate/live.py index 783d1db..8dc79ad 100644 --- a/imgcreate/live.py +++ b/imgcreate/live.py @@ -267,6 +267,7 @@ class LiveImageCreatorBase(LoopImageCreator): f = open(path, "a") f.write('filesystems+="' + self.__extra_filesystems() + ' "\n') f.write('drivers+="' + self.__extra_drivers() + ' "\n') + f.write('add_dracutmodules+=" dmsquash-live "') f.close() def __create_iso(self, isodir):

1 0

Branch 'rhel6-branch' - 2 commits - imgcreate/kickstart.py Makefile
by Brian C. Lane 23 May '13

23 May '13

Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) New commits: commit e588ccb44331e41cfde3fffa29ffea67b31e9307 Author: Brian C. Lane <bcl(a)redhat.com> Date: Thu May 23 07:20:46 2013 -0700 Version 13.4.4 diff --git a/Makefile b/Makefile index 2abfac3..9c88497 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ -VERSION = 13.4.3 +VERSION = 13.4.4 INSTALL = /usr/bin/install -c INSTALL_PROGRAM = ${INSTALL} commit e9c44265407e63d76c9bc811f2098e036cc68438 Author: Tomas Hoger <thoger(a)redhat.com> Date: Thu May 16 11:16:35 2013 -0700 Avoid setting empty root password (#962493) When using kickstart with no rootpw command, imgcreate ended up calling "passwd -d root", leaving the root account password-less. That may lead to local or remote privilege escalation. This change does the following: 1) There's no password manipulation done when password is empty string and rootpw was not called with --iscrypted 2) Password is locked when "rootpw --lock" is used Notes: Users can still shoot themselves in a foot by using: rootpw --iscrypted "" Resolves: rhbz#962493 Signed-off-by: Brian C. Lane <bcl(a)redhat.com> diff --git a/imgcreate/kickstart.py b/imgcreate/kickstart.py index 41c97ee..4abba6b 100644 --- a/imgcreate/kickstart.py +++ b/imgcreate/kickstart.py @@ -192,9 +192,9 @@ class FirewallConfig(KickstartConfig): class RootPasswordConfig(KickstartConfig): """A class to apply a kickstart root password configuration to a system.""" - def unset(self): - self.call(["/usr/bin/passwd", "-d", "root"]) - + def lock(self): + self.call(["/usr/bin/passwd", "-l", "root"]) + def set_encrypted(self, password): self.call(["/usr/sbin/usermod", "-p", password, "root"]) @@ -217,8 +217,9 @@ class RootPasswordConfig(KickstartConfig): self.set_encrypted(ksrootpw.password) elif ksrootpw.password != "": self.set_unencrypted(ksrootpw.password) - else: - self.unset() + + if ksrootpw.lock: + self.lock() class ServicesConfig(KickstartConfig): """A class to apply a kickstart services configuration to a system."""

1 0

CVE-2013-2069 livecd-tools: improper handling of passwords
by Brian C. Lane 23 May '13

23 May '13

https://bugzilla.redhat.com/show_bug.cgi?id=964299 The livecd-tools package provides support for reading and executing Kickstart files in order to create a system image. It was discovered that livecd-tools gave the root user an empty password rather than leaving the password locked in situations where no 'rootpw' directive was used or when the 'rootpw --lock' directive was used within the Kickstart file, which could allow local users to gain access to the root account. (CVE-2013-2069) Please note that livecd-tools is also used by appliance-tools to create images used for virtual machines, USB based systems, and so on. Additionally, the Python script components of livecd-tools have been broken out into a separate package named python-imgcreate on some distributions (such as Fedora). Acknowledgements: Red Hat would like to thank Amazon Web Services for reporting this issue. Amazon Web Services acknowledges Sylvain Beucler as the original reporter. -- Brian C. Lane | Anaconda Team | IRC: bcl #anaconda | Port Orchard, WA (PST8PDT)

1 0

Changes to 'refs/tags/livecd-tools-19.3'
by Brian C. Lane 23 May '13

23 May '13

Tag 'livecd-tools-19.3' created by Brian C. Lane <bcl(a)redhat.com> at 2013-05-23 13:18 +0000 Tag as livecd-tools-19.3 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQEVAwUAUZ4XGxF+jBaO/jp/AQJ0eQf+O4gwiGtJBUc0zqVmv+iShMAvZEmKgoT5 WcelEOR1BCz5nb9O6cxbgzOT8KCzfxULAvu1gODJGT2osMxCJKdokNwpHmOGrgym mupgbPbizPeJVIsrIOWb5BsZRazTI5fz2i5JGFGcYSz8fxJahH+pVcQF7kGo8T9e R9PPIYdvw6sHl0mwFGoJ66wdJe81S/2wwze5nIGbh+3aleAptmzC/Hmp5aA/k0xy hlrDSfUbWZ1oHT0Jfg3MXGkliaY0pLkwSWCrp1DI5m/Sg6h+bEFi/TLyf5y6MEdA NtbNACwnkvUneP3RPkYrv4PpoV7/kVErrcnWRekaYsyzuDkaCpsGYw== =rRGG -----END PGP SIGNATURE----- Changes since livecd-tools-19.2: Brian C. Lane (2): Handle urlgrabber callback changes (#963645) Version 19.3 Tomas Hoger (1): Avoid setting empty root password (#964299) --- Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- imgcreate/yuminst.py | 5 +++-- 3 files changed, 10 insertions(+), 8 deletions(-) ---

1 0

Changes to 'refs/tags/livecd-tools-18.16'
by Brian C. Lane 23 May '13

23 May '13

Tag 'livecd-tools-18.16' created by Brian C. Lane <bcl(a)redhat.com> at 2013-05-23 13:24 +0000 Tag as livecd-tools-18.16 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQEVAwUAUZ4YnhF+jBaO/jp/AQLniQgAnvzlxV1L3c/nYUpGc4PDA3U4Du2QOpJu +2JwvOzl6oaW9/V7SRo1W6gCU3++wQWPU9FdISggqMcZ/2zeDllBQ0oF3y84V5lP 81nL5u8iOMmqTXcNX3bbUvUYh+aLHWawpeMnFW/9L2eyYHql6UkTj/P/LyivaEAe pnucCa4WIxu+Wr8cU8TZ3z35A3PP9hyIihQyzFVELAIEib//CuglMKXJiltlzUkb XzvNIe3IBQPo5mGHdBcj9vDKdHTf5i8TBY4awW9gHSoyYD5dkPcRNi5DXLlEIf5C XkFa5T9EQd65Kux0ggQ+zWqZHDg71ftB4IbFxp4wI9MnPXzpJo6z9A== =OJc/ -----END PGP SIGNATURE----- Changes since livecd-tools-18.15: Brian C. Lane (1): Version 18.16 Tomas Hoger (1): Avoid setting empty root password (#964299) --- Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) ---

1 0

Changes to 'refs/tags/livecd-tools-17.17'
by Brian C. Lane 23 May '13

23 May '13

Tag 'livecd-tools-17.17' created by Brian C. Lane <bcl(a)redhat.com> at 2013-05-23 13:28 +0000 Tag as livecd-tools-17.17 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQEVAwUAUZ4ZaBF+jBaO/jp/AQJo6Af/fZKh8G2bL9lkuz4Sv2KD53LHEizw4pAd tIH87VJlYP+Wld9NDfq4paF5rT75nsFH5kdvU/TtSkVPd0YvegcdIm7hfj6fk2iD dQTf/gMgPC7uJzgpyTx5xqc/eQ+Zq07pAC+QDp1afWAZNcXYSX/4p6qf6AjIVpV2 n/dHYdiaJgydIJ2cOc+HdtZHwKA4wQ11W3Fg6G3BCS7GqhSmHOF6D4Rd3HYn482P q4Z00foBl8vwkmpqmPIkuQFZXIHVyUMQ6nLdmCyHdu4At1hlzT0WhhjTJCIu1wNf URNH/4631FrPc9s6mrdqCTBfbqzRk1iImSo2Awew5mPZH5nEsMJpOg== =2Gox -----END PGP SIGNATURE----- Changes since livecd-tools-17.16: Brian C. Lane (1): Version 17.17 Tomas Hoger (1): Avoid setting empty root password (#964299) --- Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) ---

1 0

Branch 'f17-branch' - 2 commits - imgcreate/kickstart.py Makefile
by Brian C. Lane 23 May '13

23 May '13

Makefile | 2 +- imgcreate/kickstart.py | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) New commits: commit ca54afa346ed1efd3a10d0933ce9f17b68517978 Author: Brian C. Lane <bcl(a)redhat.com> Date: Thu May 23 06:28:00 2013 -0700 Version 17.17 diff --git a/Makefile b/Makefile index 935249e..3a34806 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ -VERSION = 17.16 +VERSION = 17.17 INSTALL = /usr/bin/install -c INSTALL_PROGRAM = ${INSTALL} commit 132b59b2b5587eee0c8f66abea4bed28532f30e4 Author: Tomas Hoger <thoger(a)redhat.com> Date: Thu May 23 05:56:11 2013 -0700 Avoid setting empty root password (#964299) When using kickstart with no rootpw command, imgcreate ended up calling "passwd -d root", leaving the root account password-less. That may lead to local or remote privilege escalation. This change does the following: 1) There's no password manipulation done when password is empty string and rootpw was not called with --iscrypted 2) Password is locked when "rootpw --lock" is used Notes: Users can still shoot themselves in a foot by using: rootpw --iscrypted "" Resolves: rhbz#964299 (CVE-2013-2069) Signed-off-by: Brian C. Lane <bcl(a)redhat.com> diff --git a/imgcreate/kickstart.py b/imgcreate/kickstart.py index 5195e6a..3d4bbf6 100644 --- a/imgcreate/kickstart.py +++ b/imgcreate/kickstart.py @@ -199,9 +199,9 @@ class FirewallConfig(KickstartConfig): class RootPasswordConfig(KickstartConfig): """A class to apply a kickstart root password configuration to a system.""" - def unset(self): - self.call(["/usr/bin/passwd", "-d", "root"]) - + def lock(self): + self.call(["/usr/bin/passwd", "-l", "root"]) + def set_encrypted(self, password): self.call(["/usr/sbin/usermod", "-p", password, "root"]) @@ -224,8 +224,9 @@ class RootPasswordConfig(KickstartConfig): self.set_encrypted(ksrootpw.password) elif ksrootpw.password != "": self.set_unencrypted(ksrootpw.password) - else: - self.unset() + + if ksrootpw.lock: + self.lock() class ServicesConfig(KickstartConfig): """A class to apply a kickstart services configuration to a system."""

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

livecd May 2013