SUSE:SLE-12-SP2:Update   targetcli-fb   Affected
SUSE:SLE-12-SP3:Update   targetcli-fb   Affected
SUSE:SLE-15-SP1:Update   targetcli-fb   Affected
SUSE:SLE-15:Update       targetcli-fb   Affected

Submitted to factory

I submitted maint. req. for open-iscsi for SLE-15-SP2:Update, where it's been accepted.

Submitted to SLE-15-SP1:Update (req#221164).

Submitted to SLE-15:Update, but in a reduced way, since that version of targetcli-fb does not create directories, so there is no reason to protect said directories with correct permissions.

Added to SLE-12-SP3:Update.

And, lastly, submitted to SLE-12-SP2

reassigning back to the big guns

I'm testing S:M:15574:221253, in sles15sp2 platform, after upgrading the targetcli-fb program, the targetcli command creates saveconfig.json file permission attribute is always 644. If I change the permissions of the saveconfig.json file to some other value(.e.g 755), the program will not change the permissions of the file to 600. reproducer steps:

s15sp2:/etc/target # rpm -qa|grep targetcli-fb
targetcli-fb-common-2.1.52-3.3.1.noarch
python3-targetcli-fb-2.1.52-3.3.1.noarch
python2-targetcli-fb-2.1.52-3.3.1.noarch

1.
s15sp2:/etc/target # ll
total 12
drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
drw------- 2 root root 4096 Jul 27 16:11 backup
drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr

2.
s15sp2:/etc/target # targetcli
targetcli shell version 2.1.52
Copyright 2011-2013 by Datera, Inc and others.
For help on commands, type 'help'.

/> cd backstores/fileio
/backstores/fileio> create disk0 /tmp/disk0.img 10MB
Created fileio disk0 with size 10485760
/backstores/fileio> cd ../../
/> saveconfig
Configuration saved to /etc/target/saveconfig.json
/> exit
Global pref auto_save_on_exit=true
Last 10 configs saved in /etc/target/backup/.
Configuration saved to /etc/target/saveconfig.json

3.
s15sp2:/etc/target # ll
total 16
drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
drw------- 2 root root 4096 Jul 27 16:12 backup
drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
-rw-r--r-- 1 root root 1815 Jul 27 16:12 saveconfig.json   <--- new file 644


s15sp2:/etc/target # chmod 755 saveconfig.json 

s15sp2:/etc/target # targetcli
targetcli shell version 2.1.52
Copyright 2011-2013 by Datera, Inc and others.
For help on commands, type 'help'.

/> pwd
/
/> saveconfig
Last 10 configs saved in /etc/target/backup/.
Configuration saved to /etc/target/saveconfig.json
/> exit
Global pref auto_save_on_exit=true
Configuration saved to /etc/target/saveconfig.json

s15sp2:/etc/target # ll
total 16
drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
drw------- 2 root root 4096 Jul 27 16:46 backup
drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
-rwxr-xr-x 1 root root 1815 Jul 27 16:46 saveconfig.json  <--- still 755

And I also tested targetclid, which is the same result:

s15sp2:/etc # systemctl enable targetclid.socket
Created symlink /etc/systemd/system/sockets.target.wants/targetclid.socket  /usr/lib/systemd/system/targetclid.socket.

s15sp2:/etc/target # rctargetclid start

s15sp2:/etc/target # targetcli set global auto_use_daemon=true
Parameter auto_use_daemon is now 'true'.

s15sp2:/etc/target # targetcli
targetcli shell version 2.1.52
Entering targetcli interactive mode for daemonized approach.
Type 'exit' to quit.
/> saveconfig
Configuration saved to /etc/target/saveconfig.json
/> exit

s15sp2:/etc/target # ll
total 16
drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
drw------- 2 root root 4096 Jun 26 19:26 backup
drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
-rw-r--r-- 1 root root   69 Jul 27 15:50 saveconfig.json  <--- new file 644

s15sp2:/etc/target # rm -rf saveconfig.json

s15sp2:/etc/target # targetcli set global daemon_use_batch_mode=true
Parameter daemon_use_batch_mode is now 'true'.

s15sp2:/etc/target # targetcli
targetcli shell version 2.1.52
Entering targetcli batch mode for daemonized approach.
Enter multiple commands separated by newline and type 'exit' to run them all in one go.

/> saveconfig
/> exit
Configuration saved to /etc/target/saveconfig.json

s15sp2:/etc/target # ll
total 16
drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
drw------- 2 root root 4096 Jun 26 19:26 backup
drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
-rw-r--r-- 1 root root   69 Jul 27 15:55 saveconfig.json  <--- still 644

Please check the reason.

SUSE-SU-2020:2086-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1172743
CVE References: CVE-2020-13867
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Python2 15-SP1 (src):    targetcli-fb-2.1.49-10.9.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    targetcli-fb-2.1.49-10.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

What version of python3-rtslib-fb do you have? You need version 2.1.73, which was submitted to SLE-15-SP3 about 3 weeks ago.

See bsc#1173257, request#221888

(In reply to Lee Duncan from comment #15)
> What version of python3-rtslib-fb do you have? You need version 2.1.73,
> which was submitted to SLE-15-SP3 about 3 weeks ago.
> 
> See bsc#1173257, request#221888

The latest version of python3-rtslib-fb on sle15sp2 is 2.1.71-1.21. I see a correlation between S:M:15574:221253 and S:M:15683:221947, maybe I can combine them together for a test, I will assign myself S:M:15683:221947. Is my understanding correct?

SUSE-SU-2020:2101-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1172743
CVE References: CVE-2020-13867
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Python2 15-SP2 (src):    targetcli-fb-2.1.52-3.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    targetcli-fb-2.1.52-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

(In reply to ming li from comment #16)
> (In reply to Lee Duncan from comment #15)
> > What version of python3-rtslib-fb do you have? You need version 2.1.73,
> > which was submitted to SLE-15-SP3 about 3 weeks ago.
> > 
> > See bsc#1173257, request#221888
> 
> The latest version of python3-rtslib-fb on sle15sp2 is 2.1.71-1.21. I see a
> correlation between S:M:15574:221253 and S:M:15683:221947, maybe I can
> combine them together for a test, I will assign myself S:M:15683:221947. Is
> my understanding correct?

Yes, I believe so.

openSUSE-SU-2020:1141-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1172743
CVE References: CVE-2020-13867
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    targetcli-fb-2.1.49-lp151.2.10.1

openSUSE-SU-2020:1144-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1172743
CVE References: CVE-2020-13867
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    targetcli-fb-2.1.52-lp152.2.3.1

SUSE-SU-2020:2360-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1172743
CVE References: CVE-2020-13867
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    targetcli-fb-2.1.43-7.9.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

(In reply to ming li from comment #13)
> I'm testing S:M:15574:221253, in sles15sp2 platform, after upgrading the
> targetcli-fb program, the targetcli command creates saveconfig.json file
> permission attribute is always 644. If I change the permissions of the
> saveconfig.json file to some other value(.e.g 755), the program will not
> change the permissions of the file to 600. reproducer steps:
> 
> s15sp2:/etc/target # rpm -qa|grep targetcli-fb
> targetcli-fb-common-2.1.52-3.3.1.noarch
> python3-targetcli-fb-2.1.52-3.3.1.noarch
> python2-targetcli-fb-2.1.52-3.3.1.noarch
> 
> 1.
> s15sp2:/etc/target # ll
> total 12
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
> drw------- 2 root root 4096 Jul 27 16:11 backup
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
> 
> 2.
> s15sp2:/etc/target # targetcli
> targetcli shell version 2.1.52
> Copyright 2011-2013 by Datera, Inc and others.
> For help on commands, type 'help'.
> 
> /> cd backstores/fileio
> /backstores/fileio> create disk0 /tmp/disk0.img 10MB
> Created fileio disk0 with size 10485760
> /backstores/fileio> cd ../../
> /> saveconfig
> Configuration saved to /etc/target/saveconfig.json
> /> exit
> Global pref auto_save_on_exit=true
> Last 10 configs saved in /etc/target/backup/.
> Configuration saved to /etc/target/saveconfig.json
> 
> 3.
> s15sp2:/etc/target # ll
> total 16
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
> drw------- 2 root root 4096 Jul 27 16:12 backup
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
> -rw-r--r-- 1 root root 1815 Jul 27 16:12 saveconfig.json   <--- new file 644
> 
> 
> s15sp2:/etc/target # chmod 755 saveconfig.json 
> 
> s15sp2:/etc/target # targetcli
> targetcli shell version 2.1.52
> Copyright 2011-2013 by Datera, Inc and others.
> For help on commands, type 'help'.
> 
> /> pwd
> /
> /> saveconfig
> Last 10 configs saved in /etc/target/backup/.
> Configuration saved to /etc/target/saveconfig.json
> /> exit
> Global pref auto_save_on_exit=true
> Configuration saved to /etc/target/saveconfig.json
> 
> s15sp2:/etc/target # ll
> total 16
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
> drw------- 2 root root 4096 Jul 27 16:46 backup
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
> -rwxr-xr-x 1 root root 1815 Jul 27 16:46 saveconfig.json  <--- still 755
> 
> And I also tested targetclid, which is the same result:
> 
> s15sp2:/etc # systemctl enable targetclid.socket
> Created symlink /etc/systemd/system/sockets.target.wants/targetclid.socket 
> /usr/lib/systemd/system/targetclid.socket.
> 
> s15sp2:/etc/target # rctargetclid start
> 
> s15sp2:/etc/target # targetcli set global auto_use_daemon=true
> Parameter auto_use_daemon is now 'true'.
> 
> s15sp2:/etc/target # targetcli
> targetcli shell version 2.1.52
> Entering targetcli interactive mode for daemonized approach.
> Type 'exit' to quit.
> /> saveconfig
> Configuration saved to /etc/target/saveconfig.json
> /> exit
> 
> s15sp2:/etc/target # ll
> total 16
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
> drw------- 2 root root 4096 Jun 26 19:26 backup
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
> -rw-r--r-- 1 root root   69 Jul 27 15:50 saveconfig.json  <--- new file 644
> 
> s15sp2:/etc/target # rm -rf saveconfig.json
> 
> s15sp2:/etc/target # targetcli set global daemon_use_batch_mode=true
> Parameter daemon_use_batch_mode is now 'true'.
> 
> s15sp2:/etc/target # targetcli
> targetcli shell version 2.1.52
> Entering targetcli batch mode for daemonized approach.
> Enter multiple commands separated by newline and type 'exit' to run them all
> in one go.
> 
> /> saveconfig
> /> exit
> Configuration saved to /etc/target/saveconfig.json
> 
> s15sp2:/etc/target # ll
> total 16
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 alua
> drw------- 2 root root 4096 Jun 26 19:26 backup
> drwxr-xr-x 2 root root 4096 Jun  6 09:16 pr
> -rw-r--r-- 1 root root   69 Jul 27 15:55 saveconfig.json  <--- still 644
> 
> Please check the reason.

Ming: apologies for letting this slip through the cracks!

I see I have the fix for this, in SLE-15-SP2, but I never submitted it for some reason. And the comments in this bug report don't show that I've updated it, either. :-/

I have the fix in home:lee_duncan:branches:SUSE:SLE-12-SP2:Update/targetcli-fb. I will attach the RPM for x86_64. Please test, though I'm pretty sure this is the correct fix. If I don't hear back from you (it's been a while) I'll go ahead and submit this.

Created attachment 860619 [details]
RPM for SLE-15-SP2:Update x86_64 for targetcli-fb

This RPM should set mode 644 for saveconfig.json.

Reassigning back to security.

I'm not sure how to report this, but today, on our SUSE Linux Enterprise Server 15 SP3 (on which we run Ceph) I installed the targetcli-fb (package python3-targetcli-fb-2.1.54-3.3.1.noarch) and issued commands such as:

  sudo targetcli saveconfig /tmp/targetcli.conf
  sudo targetcli saveconfig ~/targetcli.json
  sudo targetcli saveconfig /dev/stdout | tee ~/targetcli.json

The output was fine, but the system started to behave very strangely afterwards.

The cause: targetcli removes r and x permissions from the parent directory (/tmp, ~, and /dev, respectively)!

I think the issue is in /usr/lib/python3.6/site-packages/targetcli/ui_root.py, lines 98-116:

  def _create_dir(self, dirname):
        '''
        create directory with permissions 0o600 set
        if directory already exists, set right perms
        '''
        mode = stat.S_IRUSR | stat.S_IWUSR # 0o600
        if not os.path.exists(dirname):
            umask = 0o777 ^ mode  # Prevents always downgrading umask to 0
            umask_original = os.umask(umask)
            try:
                os.makedirs(dirname, mode)
            except OSError as exe:
                raise ExecutionError("Cannot create directory [%s] %s."
                                     % (dirname, exe.strerror))
            finally:
                os.umask(umask_original)
        else:
            if (os.stat(dirname).st_mode & 0o777) != mode:
                os.chmod(dirname, mode)

Clearly, dirname isn't always what the latest author assumed.

I'm assuming (but don't know how to verify) that this bug was introduced as part of this attempt to fix CVE-2020-13867: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6BPXIASA4V6DSLONENRUIASAHPYZVW33/

Please try again.

Created attachment 866545 [details]
Test diffs for fixing this issue.


Hi:

I can submit an update upstream, but can you test it first, just for a 2nd set of eyes? I tested it locally.

You will have to edit /usr/lib/python3.6/site-packages/targetcli/ui_root.py, so save a copy of it before you do. (I could also supply an RPM, if you prefer.) I'm pretty sure my changes are functionally correct, i.e. it now skips setting the mode of an existing directory unless it's /etc/target.

Personally, I dislike it setting the mode of any existing target -- isn't that the job of the sysadm? But that's just me.

I will submit this upstream (assuming it works for you), then it can make it's way into SUSE Linux.

Note: in anticipation of this working for you (and since I tested it), I submitted a pull request upstream. I assume it will take them a bit to get to it.

See https://github.com/open-iscsi/targetcli-fb/pull/198

Taking this bug.

Changes for this submitted for Factory, since I haven't heard back from upstream yet.

I'm in awe at the speed at which this has been addressed.

I just tested on SUSE Linux Enterprise Server 15 SP4 (which our test servers run) and indeed, it fixes the issue.

Thanks a lot!

All done, closing.