Add symlink and chown checks when accessing key path#2192
Open
norakoiralamsft wants to merge 1 commit into
Open
Add symlink and chown checks when accessing key path#2192norakoiralamsft wants to merge 1 commit into
norakoiralamsft wants to merge 1 commit into
Conversation
norakoiralamsft
requested review from
a team,
D1v38om83r and
nkuchta
as code owners
jscalev
reviewed
Jul 7, 2026
|
|
||
|
|
||
| def validate_ssh_path(pub_path, user_name): | ||
| p = pwd.getpwnam(user_name) |
Contributor
There was a problem hiding this comment.
Can this return a nil or err?
jscalev
reviewed
Jul 7, 2026
| uid = p.pw_uid | ||
|
|
||
| ssh_dir = os.path.dirname(pub_path) | ||
|
|
jscalev
reviewed
Jul 7, 2026
| raise Exception("Refusing to write: {0} is not owned by {1} or root".format(ssh_dir, user_name)) | ||
|
|
||
| # Validate authorized_keys is not a symlink and is owned by the target user | ||
| if os.path.islink(pub_path): |
Contributor
There was a problem hiding this comment.
Nit: could create a helper method since the code above is the same
jscalev
reviewed
Jul 7, 2026
| # overwrite the default logger | ||
| logger.global_shared_context_logger = logger.Logger('/var/log/waagent.log', '/dev/stdout') | ||
|
|
||
|
|
Contributor
There was a problem hiding this comment.
Overall comment. unit tests?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The PR aims to address improper handling of symbolic links in the process of resetting or setting SSH public keys for existing Linux users.
This was the suggested mitigation : Open the target with O_NOFOLLOW (and O_EXCL when creating), or verify with os.lstat/os.path.islink that the final path component is not a symlink immediately before writing. Replace os.chown with os.lchown so ownership changes never follow a symlink. Before operating, validate that the parent .ssh directory and the authorized_keys file are owned by the target user and are not symlinks; refuse otherwise. Apply the same guards to the SSH2/PKCS8 conversion branch (ssh_deploy_public_key).