Merge lp:~mvo/aptdaemon/admin-group-fix into lp:aptdaemon

[Michael Vogt]

Please consider the following patch to support both the "admin" and the "sudo" group.
In ubuntu 12.04 the new group is "sudo" but on old installs the "admin" group is still in use
and users are not transitioned over. So aptdaemon needs to support both.

[lp:~mvo/aptdaemon/admin-group-fix]

777. By Michael Vogt on 2012-03-02

ensure mode is 0640 for protected source files

778. By Michael Vogt on 2012-03-02

skip the test is the user is not in the right group

[Michael Vogt (mvo)]

I udpated the test a bit to ensure that it will not fail when run as a non-{sudo,admin} group user now. How does it look ?

[Michael Vogt (mvo)]

As discussed on irc the better solution is probably to use the /etc/apt/auth.conf file for the username/passwords.

The file has the form:

machine private-ppa.launchpad.net/path
login username
password token

Alternatively it can be tab seperated, its using strtok_r(.."\n\t"..)

Unmerged revisions

778. By Michael Vogt on 2012-03-02

skip the test is the user is not in the right group

777. By Michael Vogt on 2012-03-02

ensure mode is 0640 for protected source files

776. By Michael Vogt on 2012-02-28

user the transaction uid to figure out what group to use and add a test

775. By Michael Vogt on 2012-02-28

aptdaemon/worker.py: support both admin (if available) and sudo group

774. By Michael Vogt on 2012-02-28

aptdaemon/worker.py: use root.sudo instead of root.admin as the former is no longer used in ubuntu/debian

=== modified file 'aptdaemon/worker.py'
--- aptdaemon/worker.py	2012-01-27 18:09:17 +0000
+++ aptdaemon/worker.py	2012-03-02 09:15:24 +0000
@@ -457,16 +457,33 @@
             raise
         else:
             sources.save()
-            # set to sourcesfile root.admin only if there is a password
+            # set to sourcesfile root.{admin,sudo} or root.sudo only if there
+            # is a password
             if password_in_uri and sourcesfile:
-                import grp
-                try:
-                    os.chown(sourcesfile, 0, grp.getgrnam("admin")[2])
-                except Exception as e:
-                    logging.warn("os.chmod() failed '%s'" % e)
+                self._protect_sources_list(trans.uid, sourcesfile)
         finally:
             os.umask(old_umask)
 
+    def _protect_sources_list(self, user_uid, sourcesfile, owner_uid=0):
+        """ this will chown the sourcesfile with either 
+            root.admin or root.sudo permissions
+        """
+        import grp,pwd
+        # ubuntu may either have admin or sudo as the group, figure out
+        # there which one to use
+        gid = None
+        user = pwd.getpwuid(user_uid).pw_name
+        for group in grp.getgrall():
+            if (group.gr_name in ["admin", "sudo"] and 
+                user in group.gr_mem):
+                gid = group.gr_gid
+                break
+        try:
+            os.chmod(sourcesfile, 0640)
+            os.chown(sourcesfile, owner_uid, gid)
+        except Exception as e:
+            logging.warn("os.chmod() failed '%s'" % e)
+
     def add_vendor_key_from_keyserver(self, trans, keyid, keyserver):
         """Add the signing key from the given (keyid, keyserver) to the
         trusted vendors.

=== modified file 'tests/test_worker.py'
--- tests/test_worker.py	2012-01-23 10:32:24 +0000
+++ tests/test_worker.py	2012-03-02 09:15:24 +0000
@@ -25,9 +25,12 @@
 import glob
 import os
 import shutil
+import stat
 import sys
+import tempfile
 import unittest
 
+
 import apt_pkg
 from gi.repository import GObject
 import dbus
@@ -362,6 +365,7 @@
         self.worker._cache.open()
         self.assertEqual(self.worker._cache.broken_count, 0)
 
+
     def test_add_license_key_unsecure(self):
         """Test if we refuse to install license key files to an unsecure
         location or binaries."""
@@ -380,6 +384,28 @@
         self.assertRaises(errors.TransactionFailed,
                           self.worker._add_license_key_to_system,
                           pkg_name, license_key, license_key_path)
+
+    def in_sudo_or_admin_group():
+        import getpass, grp
+        user = getpass.getuser()
+        for groupname in ["sudo", "admin"]:
+            try:
+                if user in grp.getgrnam(groupname).gr_mem:
+                    return True
+            except KeyError:
+                continue
+        return False
+    @unittest.skipUnless(in_sudo_or_admin_group(), 
+                         "skipped as the user is not in the admin group")
+    def test_protect_sources_list(self):
+        uid = os.getuid()            
+        f = tempfile.NamedTemporaryFile()
+        os.chown(f.name, uid, uid)
+        self.assertEqual(os.stat(f.name).st_gid, uid)
+        self.worker._protect_sources_list(uid, f.name, uid)
+        buf = os.stat(f.name)
+        self.assertNotEqual(buf.st_gid, uid)
+        self.assertEqual(stat.S_IMODE(buf.st_mode), 0640)
  
     def test_add_license_key(self):
         """Test the installation of license key files."""