pym/portage/data.py

   1 # data.py -- Calculated/Discovered Data Values
   2 # Copyright 1998-2009 Gentoo Foundation
   3 # Distributed under the terms of the GNU General Public License v2
   4 # $Id$
   5
   6 import os, sys, pwd, grp, platform
   7
   8 import portage
   9 portage.proxy.lazyimport.lazyimport(globals(),
  10         'portage.util:writemsg',
  11 )
  12
  13 from portage.output import colorize
  14 from portage.output import create_color_func
  15 bad = create_color_func("BAD")
  16
  17 ostype=platform.system()
  18 userland = None
  19 if ostype == "DragonFly" or ostype.endswith("BSD"):
  20         userland = "BSD"
  21 else:
  22         userland = "GNU"
  23
  24 lchown = getattr(os, "lchown", None)
  25
  26 if not lchown:
  27         if ostype == "Darwin":
  28                 def lchown(*pos_args, **key_args):
  29                         pass
  30         else:
  31                 try:
  32                         import missingos
  33                         lchown = missingos.lchown
  34                 except ImportError:
  35                         def lchown(*pos_args, **key_args):
  36                                 writemsg(colorize("BAD", "!!!") + \
  37                                         " It seems that os.lchown does not" + \
  38                                         " exist.  Please rebuild python.\n", noiselevel=-1)
  39                         lchown()
  40
  41 def portage_group_warning():
  42         warn_prefix = bad("*** WARNING ***  ")
  43         mylines = [
  44                 "For security reasons, only system administrators should be",
  45                 "allowed in the portage group.  Untrusted users or processes",
  46                 "can potentially exploit the portage group for attacks such as",
  47                 "local privilege escalation."
  48         ]
  49         for x in mylines:
  50                 writemsg(warn_prefix, noiselevel=-1)
  51                 writemsg(x, noiselevel=-1)
  52                 writemsg("\n", noiselevel=-1)
  53         writemsg("\n", noiselevel=-1)
  54
  55 # Portage has 3 security levels that depend on the uid and gid of the main
  56 # process and are assigned according to the following table:
  57 #
  58 # Privileges  secpass  uid    gid
  59 # normal      0        any    any
  60 # group       1        any    portage_gid
  61 # super       2        0      any
  62 #
  63 # If the "wheel" group does not exist then wheelgid falls back to 0.
  64 # If the "portage" group does not exist then portage_uid falls back to wheelgid.
  65
  66 secpass=0
  67
  68 uid=os.getuid()
  69 wheelgid=0
  70
  71 if uid==0:
  72         secpass=2
  73 try:
  74         wheelgid=grp.getgrnam("wheel")[2]
  75 except KeyError:
  76         pass
  77
  78 #Discover the uid and gid of the portage user/group
  79 try:
  80         portage_uid=pwd.getpwnam("portage")[2]
  81         portage_gid=grp.getgrnam("portage")[2]
  82         if secpass < 1 and portage_gid in os.getgroups():
  83                 secpass=1
  84 except KeyError:
  85         portage_uid=0
  86         portage_gid=0
  87         writemsg(colorize("BAD",
  88                 "portage: 'portage' user or group missing.") + "\n", noiselevel=-1)
  89         writemsg(
  90                 "         For the defaults, line 1 goes into passwd, " + \
  91                 "and 2 into group.\n", noiselevel=-1)
  92         writemsg(colorize("GOOD",
  93                 "         portage:x:250:250:portage:/var/tmp/portage:/bin/false") \
  94                 + "\n", noiselevel=-1)
  95         writemsg(colorize("GOOD", "         portage::250:portage") + "\n",
  96                 noiselevel=-1)
  97         portage_group_warning()
  98
  99 userpriv_groups = [portage_gid]
 100 if secpass >= 2:
 101         # Get a list of group IDs for the portage user.  Do not use grp.getgrall()
 102         # since it is known to trigger spurious SIGPIPE problems with nss_ldap.
 103         from commands import getstatusoutput
 104         mystatus, myoutput = getstatusoutput("id -G portage")
 105         if mystatus == os.EX_OK:
 106                 for x in myoutput.split():
 107                         try:
 108                                 userpriv_groups.append(int(x))
 109                         except ValueError:
 110                                 pass
 111                         del x
 112                 userpriv_groups = list(set(userpriv_groups))
 113         del getstatusoutput, mystatus, myoutput