···

       
61
       
 
       
    os.setuid(uid)

     

       
62
       
 
       


     

       
63
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
64
       
 
       
def taskd_cmd(cmd, *args, **kwargs):

     

       
65
       
 
       
    """

     

       
66
       
 
       
    Invoke taskd with the specified command with the privileges of the 'taskd'

     
···

       
90
       
 
       
    """

     

       
91
       
 
       
    return subprocess.check_output(

     

       
92
       
 
       
        [CERTTOOL_COMMAND] + list(args),

     

       
93
       
-
       
        preexec_fn=lambda: os.umask(0o077),

     

       
94
       
 
       
        stderr=subprocess.STDOUT,

     

       
95
       
 
       
        **kwargs

     

       
96
       
 
       
    )

     
···

       
156
       
 
       
        sys.stderr.write(msg.format(user))

     

       
157
       
 
       
        return

     

       
158
       
 
       


     

       
159
       
-
       
    basedir = os.path.join(TASKD_DATA_DIR, "keys", org, user)

     

       
160
       
-
       
    if os.path.exists(basedir):

     

       
0
       
 
       

     

       
0
       
 
       

     

       
161
       
 
       
        raise OSError("Keyfile directory for {} already exists.".format(user))

     

       
162
       
 
       


     

       
163
       
-
       
    privkey = os.path.join(basedir, "private.key")

     

       
164
       
-
       
    pubcert = os.path.join(basedir, "public.cert")

     

       
165
       
 
       


     

       
166
       
 
       
    try:

     

       
167
       
-
       
        os.makedirs(basedir, mode=0o700)

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
168
       
 
       


     

       
169
       
 
       
        certtool_cmd("-p", "--bits", CERT_BITS, "--outfile", privkey)

     

       
0
       
 
       

     

       
170
       
 
       


     

       
171
       
 
       
        template_data = [

     

       
172
       
 
       
            "organization = {0}".format(org),

     
···

       
187
       
 
       
                "--outfile", pubcert

     

       
188
       
 
       
            )

     

       
189
       
 
       
    except:

     

       
190
       
-
       
        rmtree(basedir)

     

       
191
       
 
       
        raise

     

       
192
       
 
       


     

       
193
       
 
       


     

···

       
61
       
 
       
    os.setuid(uid)

     

       
62
       
 
       


     

       
63
       
 
       


     

       
64
       
+
       
def run_as_taskd_group():

     

       
65
       
+
       
    gid = grp.getgrnam(TASKD_GROUP).gr_gid

     

       
66
       
+
       
    os.setgid(gid)

     

       
67
       
+
       


     

       
68
       
 
       
def taskd_cmd(cmd, *args, **kwargs):

     

       
69
       
 
       
    """

     

       
70
       
 
       
    Invoke taskd with the specified command with the privileges of the 'taskd'

     
···

       
94
       
 
       
    """

     

       
95
       
 
       
    return subprocess.check_output(

     

       
96
       
 
       
        [CERTTOOL_COMMAND] + list(args),

     

       
97
       
+
       
        preexec_fn=run_as_taskd_group,

     

       
98
       
 
       
        stderr=subprocess.STDOUT,

     

       
99
       
 
       
        **kwargs

     

       
100
       
 
       
    )

     
···

       
160
       
 
       
        sys.stderr.write(msg.format(user))

     

       
161
       
 
       
        return

     

       
162
       
 
       


     

       
163
       
+
       
    keysdir = os.path.join(TASKD_DATA_DIR, "keys" )

     

       
164
       
+
       
    orgdir  = os.path.join(keysdir       , org    )

     

       
165
       
+
       
    userdir = os.path.join(orgdir        , user   )

     

       
166
       
+
       
    if os.path.exists(userdir):

     

       
167
       
 
       
        raise OSError("Keyfile directory for {} already exists.".format(user))

     

       
168
       
 
       


     

       
169
       
+
       
    privkey = os.path.join(userdir, "private.key")

     

       
170
       
+
       
    pubcert = os.path.join(userdir, "public.cert")

     

       
171
       
 
       


     

       
172
       
 
       
    try:

     

       
173
       
+
       
        # We change the permissions and the owner ship of the base directories

     

       
174
       
+
       
        # so that cfg.group and cfg.user could read the directories' contents.

     

       
175
       
+
       
        # See also: https://bugs.python.org/issue42367

     

       
176
       
+
       
        for bd in [keysdir, orgdir, userdir]:

     

       
177
       
+
       
            # Allow cfg.group, but not others to read the contents of this group

     

       
178
       
+
       
            os.makedirs(bd, exist_ok=True)

     

       
179
       
+
       
            # not using mode= argument to makedirs intentionally - forcing the

     

       
180
       
+
       
            # permissions we want

     

       
181
       
+
       
            os.chmod(bd, mode=0o750)

     

       
182
       
+
       
            os.chown(

     

       
183
       
+
       
                bd,

     

       
184
       
+
       
                uid=pwd.getpwnam(TASKD_USER).pw_uid,

     

       
185
       
+
       
                gid=grp.getgrnam(TASKD_GROUP).gr_gid,

     

       
186
       
+
       
            )

     

       
187
       
 
       


     

       
188
       
 
       
        certtool_cmd("-p", "--bits", CERT_BITS, "--outfile", privkey)

     

       
189
       
+
       
        os.chmod(privkey, 0o640)

     

       
190
       
 
       


     

       
191
       
 
       
        template_data = [

     

       
192
       
 
       
            "organization = {0}".format(org),

     
···

       
207
       
 
       
                "--outfile", pubcert

     

       
208
       
 
       
            )

     

       
209
       
 
       
    except:

     

       
210
       
+
       
        rmtree(userdir)

     

       
211
       
 
       
        raise

     

       
212
       
 
       


     

       
213