Merge lp:~clint-fewbar/ubuntu/oneiric/cobbler/misc-fixes into lp:ubuntu/oneiric/cobbler

[Clint Byrum]

Sanity check please.. fixing some recently reported bugs. Thanks!

[lp:~clint-fewbar/ubuntu/oneiric/cobbler/misc-fixes]

51. By Clint Byrum on 2011-10-01

debian/cobbler-common.install: remove users.digest as it is
not required and contains a known password that would leave
cobblerd vulnerable if started before configuration is done.

52. By Clint Byrum on 2011-10-01

debian/cobbler-web.postinst: fix perms on webui_sessions to
be more secure (LP: #863755)

Unmerged revisions

52. By Clint Byrum on 2011-10-01

debian/cobbler-web.postinst: fix perms on webui_sessions to
be more secure (LP: #863755)

51. By Clint Byrum on 2011-10-01

debian/cobbler-common.install: remove users.digest as it is
not required and contains a known password that would leave
cobblerd vulnerable if started before configuration is done.

50. By Clint Byrum on 2011-10-01

* debian/cobbler.postinst: create users.digest mode 0600 so it
  is not world readable. (LP: #858860)
* debian/control: cobbler needs to depend on python-cobbler
  (LP: #863738)
* debian/patches/58_fix_egg_cache.patch: Do not point dangerous
  PYTHON_EGG_CACHE at world writable directory. (LP: #858875)

=== added directory '.pc/58_fix_egg_cache.patch'
=== added file '.pc/58_fix_egg_cache.patch/.timestamp'
=== added directory '.pc/58_fix_egg_cache.patch/web'
=== added file '.pc/58_fix_egg_cache.patch/web/cobbler.wsgi'
--- .pc/58_fix_egg_cache.patch/web/cobbler.wsgi	1970-01-01 00:00:00 +0000
+++ .pc/58_fix_egg_cache.patch/web/cobbler.wsgi	2011-10-01 05:41:24 +0000
@@ -0,0 +1,10 @@
+import os
+import sys
+
+os.environ['DJANGO_SETTINGS_MODULE'] = 'settings'
+os.environ['PYTHON_EGG_CACHE'] = '/tmp'
+sys.path.append('/usr/share/cobbler/web')
+sys.path.append('/usr/share/cobbler/web/cobbler_web')
+
+import django.core.handlers.wsgi
+application = django.core.handlers.wsgi.WSGIHandler()

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2011-09-01 20:08:17 +0000
+++ .pc/applied-patches	2011-10-01 05:41:24 +0000
@@ -21,3 +21,4 @@
 55_ubuntu_branding.patch
 56_ubuntu_arm_generate_pxe_files.patch
 57_ubuntu_dnsmasq_domain.patch
+58_fix_egg_cache.patch

=== modified file 'debian/changelog'
--- debian/changelog	2011-09-29 23:58:08 +0000
+++ debian/changelog	2011-10-01 05:41:24 +0000
@@ -1,3 +1,19 @@
+cobbler (2.1.0+git20110602-0ubuntu27) UNRELEASED; urgency=low
+
+  * debian/cobbler.postinst: create users.digest mode 0600 so it
+    is not world readable. (LP: #858860)
+  * debian/control: cobbler needs to depend on python-cobbler 
+    (LP: #863738)
+  * debian/patches/58_fix_egg_cache.patch: Do not point dangerous
+    PYTHON_EGG_CACHE at world writable directory. (LP: #858875)
+  * debian/cobbler-common.install: remove users.digest as it is
+    not required and contains a known password that would leave
+    cobblerd vulnerable if started before configuration is done.
+  * debian/cobbler-web.postinst: fix perms on webui_sessions to
+    be more secure (LP: #863755)
+
+ -- Clint Byrum <[e-mail]>  Fri, 30 Sep 2011 22:36:46 -0700
+
 cobbler (2.1.0+git20110602-0ubuntu26) oneiric; urgency=low
 
   * debian/cobbler-ubuntu-import: Add --check-update and --remove

=== modified file 'debian/cobbler-common.install'
--- debian/cobbler-common.install	2011-09-08 13:01:55 +0000
+++ debian/cobbler-common.install	2011-10-01 05:41:24 +0000
@@ -4,7 +4,6 @@
 etc/cobbler/settings
 etc/cobbler/tftpd.template
 etc/cobbler/users.conf
-etc/cobbler/users.digest
 etc/cobbler/version
 etc/cobbler/zone.template
 etc/cobbler/cheetah_macros

=== modified file 'debian/cobbler-web.dirs'
--- debian/cobbler-web.dirs	2011-04-04 12:55:44 +0000
+++ debian/cobbler-web.dirs	2011-10-01 05:41:24 +0000
@@ -1,1 +1,2 @@
 var/lib/cobbler/webui_sessions
+var/lib/cobbler/webui_cache

=== modified file 'debian/cobbler-web.postinst'
--- debian/cobbler-web.postinst	2011-09-06 14:11:49 +0000
+++ debian/cobbler-web.postinst	2011-10-01 05:41:24 +0000
@@ -9,6 +9,9 @@
 		ln -s /etc/cobbler/cobbler_web.conf /etc/apache2/conf.d/cobbler_web.conf 
 	fi
 	chown www-data:www-data /var/lib/cobbler/webui_sessions
+	chmod 0700 /var/lib/cobbler/webui_sessions
+	chown www-data:www-data /var/lib/cobbler/webui_cache
+	chmod 0700 /var/lib/cobbler/webui_sessions
 	a2enmod proxy_http
 	a2enmod wsgi
 

=== modified file 'debian/cobbler.postinst'
--- debian/cobbler.postinst	2011-06-08 17:21:45 +0000
+++ debian/cobbler.postinst	2011-10-01 05:41:24 +0000
@@ -8,6 +8,7 @@
 	db_get cobbler/password || true
 	password="$RET"
 	hash=$(printf "cobbler:Cobbler:$password" | md5sum | awk '{print $1}')
+	[ -e /etc/cobbler/users.digest ] || install -o root -g root -m 0600 /dev/null /etc/cobbler/users.digest
 	htpasswd -D /etc/cobbler/users.digest "cobbler" || true
 	printf "cobbler:Cobbler:$hash\n" >> /etc/cobbler/users.digest
 	hash=$(printf "$password" | openssl passwd -1 -stdin)

=== modified file 'debian/control'
--- debian/control	2011-08-26 12:58:21 +0000
+++ debian/control	2011-10-01 05:41:24 +0000
@@ -74,7 +74,8 @@
 
 Package: cobbler-common
 Architecture: all
-Depends: ${misc:Depends}
+Depends: ${misc:Depends},
+ python-cobbler (= ${binary:Version})
 Provides: ${python:Provides}
 Description: Cobbler Install server - common files
  Cobbler is a network install server. Cobbler supports PXE, virtualized 
@@ -89,8 +90,7 @@
 
 Package: cobbler-web
 Architecture: all
-Depends: python-cobbler (= ${binary:Version}),
- cobbler-common (= ${binary:Version} ),
+Depends: cobbler-common (= ${binary:Version} ),
  libapache2-mod-python,
  libapache2-mod-wsgi,
  ttf-ubuntu-font-family,

=== added file 'debian/patches/58_fix_egg_cache.patch'
--- debian/patches/58_fix_egg_cache.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/58_fix_egg_cache.patch	2011-10-01 05:41:24 +0000
@@ -0,0 +1,19 @@
+Author: Clint Byrum <[e-mail]>
+Description: Changes PYTHON_EGG_CACHE to a safer path owned just by the webserver.
+Bug: https://fedorahosted.org/cobbler/ticket/688
+Bug-Ubuntu: http://pad.lv/858875
+Forwarded: yes
+
+Index: cobbler/web/cobbler.wsgi
+===================================================================
+--- cobbler.orig/web/cobbler.wsgi	2011-09-30 16:53:26.522621805 -0700
++++ cobbler/web/cobbler.wsgi	2011-09-30 17:09:53.909158191 -0700
+@@ -2,7 +2,7 @@
+ import sys
+ 
+ os.environ['DJANGO_SETTINGS_MODULE'] = 'settings'
+-os.environ['PYTHON_EGG_CACHE'] = '/tmp'
++os.environ['PYTHON_EGG_CACHE'] = '/var/lib/cobbler/webui_cache'
+ sys.path.append('/usr/share/cobbler/web')
+ sys.path.append('/usr/share/cobbler/web/cobbler_web')
+ 

=== modified file 'debian/patches/series'
--- debian/patches/series	2011-09-01 20:08:17 +0000
+++ debian/patches/series	2011-10-01 05:41:24 +0000
@@ -21,3 +21,4 @@
 55_ubuntu_branding.patch
 56_ubuntu_arm_generate_pxe_files.patch
 57_ubuntu_dnsmasq_domain.patch
+58_fix_egg_cache.patch

=== modified file 'web/cobbler.wsgi'
--- web/cobbler.wsgi	2011-03-31 08:54:56 +0000
+++ web/cobbler.wsgi	2011-10-01 05:41:24 +0000
@@ -2,7 +2,7 @@
 import sys
 
 os.environ['DJANGO_SETTINGS_MODULE'] = 'settings'
-os.environ['PYTHON_EGG_CACHE'] = '/tmp'
+os.environ['PYTHON_EGG_CACHE'] = '/var/lib/cobbler/webui_cache'
 sys.path.append('/usr/share/cobbler/web')
 sys.path.append('/usr/share/cobbler/web/cobbler_web')