[Pkg-zenoss-team] [Zenoss] #1746: [security] unsafe use of os.makedirs

[Zenoss]

#1746: [security] unsafe use of os.makedirs
----------------------+-----------------------------------------------------
 Reporter:  bzeimetz  |       Owner:  edahl       
     Type:  defect    |      Status:  new         
 Priority:  blocker   |   Milestone:  zenoss-2.0.1
Component:  All       |     Version:  2.0.0       
 Severity:  Days      |    Keywords:  security    
----------------------+-----------------------------------------------------
 os.makedirs creates directories with a default mode of 0777 unless
 otherwise specified. this could result at least in a data loss or modifies
 data, as the created directories are world-writeable. In the worst case an
 attacker could insert code into a zenpack (I didn't test that, but on the
 first look it seems so).

 makedirs(path[, mode]) takes a parameter mode which should be <= 0775 if
 the directory is owned by a group which was created for the zenoss user,
 od <= 0755 if we don't know if it's safe to give write access to the
 group.
 In my opinion the best mode would be 0750.

 Affected files in Products:

 {{{
 0 bzed at hal:~/workspace/debian/pkg-zenoss/upstream/zenoss/Products$ grep -r
 makedirs * | grep -v \.svn
 GenericSetup/tests/common.py:        os.makedirs( subdir )
 GenericSetup/context.py:            os.makedirs( prefix )
 ZenModel/DataRoot.py:            os.makedirs(zp)
 ZenModel/DataRoot.py:                os.makedirs(os.path.join(zp, d))
 ZenModel/DataRoot.py:            os.makedirs(skinsDir2)
 ZenRelations/schemadoc.py:        if not os.path.isdir(dirname):
 os.makedirs(dirname)
 ZenRRD/RRDUtil.py:                os.makedirs(dirname)
 ZenRRD/plugins/plugin.py:    os.makedirs(TMPDIR)
 ZenRRD/RenderServer.py:                os.makedirs(self.tmpdir)
 ZenRRD/zenperfsnmp.py:        os.makedirs(dir)
 ZenRRD/zenperfxmlrpc.py:            os.makedirs(perfRoot)
 ZenUtils/zenpack.py:                    os.makedirs(fullname)
 ZenUtils/zenpack.py:                    os.makedirs(base)
 }}}

-- 
Ticket URL: <http://dev.zenoss.com/trac/ticket/1746>
Zenoss <http://example.com/>
Zenoss Monitoring System