From adab286bf9d96bfec17ad3a7e7cd488315cbe769 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Tue, 23 Apr 2024 17:12:43 +0200 Subject: [PATCH] board/common: ensure /run/system.json is readable only wheel group Writable by root, readble only by wheel members, e.g. admin. Signed-off-by: Joachim Wiberg --- board/common/rootfs/libexec/infix/probe | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/board/common/rootfs/libexec/infix/probe b/board/common/rootfs/libexec/infix/probe index 9a2797ff..ee5264fd 100755 --- a/board/common/rootfs/libexec/infix/probe +++ b/board/common/rootfs/libexec/infix/probe @@ -3,12 +3,13 @@ import importlib.machinery import json import os +import shutil import struct import subprocess import sys onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module() - +SYSTEM_JSON = "/run/system.json" KKIT_IANA_PEM = 61046 class DTSystem: @@ -302,8 +303,11 @@ def main(): "NO FACTORY PASSWORD FOUND\033[0m\n\n") err = 1 - json.dump(out, open("/run/system.json", "w")) - os.chmod("/run/system.json", 0o444) + os.umask(0o337) + # pylint: disable=invalid-name + with open(SYSTEM_JSON, "w", encoding="ascii") as f: + json.dump(out, f) + shutil.chown(SYSTEM_JSON, user="root", group="wheel") return err if __name__ == "__main__":