fix: never let root read the SSH configuration from stdin
CI / test (3.10) (push) Successful in 23s
CI / test (3.11) (push) Successful in 22s
CI / test (3.12) (push) Successful in 24s
CI / test (3.10) (pull_request) Successful in 23s
CI / test (3.11) (pull_request) Successful in 25s
CI / test (3.12) (pull_request) Successful in 24s
CI / test (3.10) (push) Successful in 23s
CI / test (3.11) (push) Successful in 22s
CI / test (3.12) (push) Successful in 24s
CI / test (3.10) (pull_request) Successful in 23s
CI / test (3.11) (pull_request) Successful in 25s
CI / test (3.12) (pull_request) Successful in 24s
A driver gains root with sudo -S and puts the password in front of stdin. A sudo that does not prompt -- NOPASSWD, a cached timestamp -- leaves it there, and the cat under sudo wrote it into the drop-in as its first line. Seen on the first real run (NetOrk/netork#1027): sshd -t rejected the file and the rollback removed it, but the password was in a 0644 file for a moment and in the error the caller showed. The content now goes without privilege to a mktemp file only the login user can read; root installs that file (mode 644, root-owned) and removes it. The fake host in the tests prepends the password to every privileged stdin, as a non-prompting sudo does. Bumps to 4.5.1. NetOrk/netork#1027, NetOrk/netork#1029
This commit is contained in:
1 parent
d43e15e8db
commit
7ec427c743
3 files changed
+60
-9
No files matched your search
+1
-1
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
|
||||
|
||||
[project]
|
||||
name = "napalm-device-types"
|
||||
version = "4.5.0"
|
||||
version = "4.5.1"
|
||||
description = "Abstract device-type base classes for NAPALM drivers"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.10"
|
||||
|
||||
Reference in new issue
Block a user