Makefile | 2 +-
imgcreate/kickstart.py | 11 ++++++-----
2 files changed, 7 insertions(+), 6 deletions(-)
New commits:
commit ca54afa346ed1efd3a10d0933ce9f17b68517978
Author: Brian C. Lane <bcl(a)redhat.com>
Date: Thu May 23 06:28:00 2013 -0700
Version 17.17
diff --git a/Makefile b/Makefile
index 935249e..3a34806 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
-VERSION = 17.16
+VERSION = 17.17
INSTALL = /usr/bin/install -c
INSTALL_PROGRAM = ${INSTALL}
commit 132b59b2b5587eee0c8f66abea4bed28532f30e4
Author: Tomas Hoger <thoger(a)redhat.com>
Date: Thu May 23 05:56:11 2013 -0700
Avoid setting empty root password (#964299)
When using kickstart with no rootpw command, imgcreate ended up calling
"passwd -d root", leaving the root account password-less. That may lead to
local or remote privilege escalation.
This change does the following:
1) There's no password manipulation done when password is empty string and
rootpw was not called with --iscrypted
2) Password is locked when "rootpw --lock" is used
Notes:
Users can still shoot themselves in a foot by using: rootpw --iscrypted ""
Resolves: rhbz#964299 (CVE-2013-2069)
Signed-off-by: Brian C. Lane <bcl(a)redhat.com>
diff --git a/imgcreate/kickstart.py b/imgcreate/kickstart.py
index 5195e6a..3d4bbf6 100644
--- a/imgcreate/kickstart.py
+++ b/imgcreate/kickstart.py
@@ -199,9 +199,9 @@ class FirewallConfig(KickstartConfig):
class RootPasswordConfig(KickstartConfig):
"""A class to apply a kickstart root password configuration to a system."""
- def unset(self):
- self.call(["/usr/bin/passwd", "-d", "root"])
-
+ def lock(self):
+ self.call(["/usr/bin/passwd", "-l", "root"])
+
def set_encrypted(self, password):
self.call(["/usr/sbin/usermod", "-p", password, "root"])
@@ -224,8 +224,9 @@ class RootPasswordConfig(KickstartConfig):
self.set_encrypted(ksrootpw.password)
elif ksrootpw.password != "":
self.set_unencrypted(ksrootpw.password)
- else:
- self.unset()
+
+ if ksrootpw.lock:
+ self.lock()
class ServicesConfig(KickstartConfig):
"""A class to apply a kickstart services configuration to a system."""