Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
S
SteamOS Devkit Client
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Deploy
Releases
Package registry
Model registry
Operate
Terraform modules
Monitor
Incidents
Analyze
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
devkit
SteamOS Devkit Client
Commits
5b401fd1
Commit
5b401fd1
authored
1 year ago
by
Timothee Besset
Browse files
Options
Downloads
Patches
Plain Diff
Improve permission management of the devkit ssh key.
parent
ebdfe5d5
No related branches found
No related tags found
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
ChangeLog
+4
-0
4 additions, 0 deletions
ChangeLog
client/devkit_client/__init__.py
+41
-32
41 additions, 32 deletions
client/devkit_client/__init__.py
with
45 additions
and
32 deletions
ChangeLog
+
4
−
0
View file @
5b401fd1
2023-06-13 Timothee Besset <ttimo@valvesoftware.com>
* Release v.0.20230613.0
* Improve permission management of the devkit ssh key.
* Windows: migrate to Python 3.11
* Windows: migrate to Python 3.11
2023-04-09 Timothee Besset <ttimo@valvesoftware.com>
2023-04-09 Timothee Besset <ttimo@valvesoftware.com>
...
...
This diff is collapsed.
Click to expand it.
client/devkit_client/__init__.py
+
41
−
32
View file @
5b401fd1
...
@@ -460,6 +460,40 @@ def get_public_key(key):
...
@@ -460,6 +460,40 @@ def get_public_key(key):
return
public_key
return
public_key
def
_fix_key_permissions
(
key_path
,
pubkey_path
):
if
platform
.
system
()
==
'
Linux
'
:
# enforce/fix file permissions
os
.
chmod
(
key_path
,
0o400
)
os
.
chmod
(
pubkey_path
,
0o400
)
else
:
# fix permissions for private keys the windows way, keep ssh happy
# do not rely on get_username here, use the full domain\name of the current user - some systems fail if you just give username
# also icacls.exe docs suggest this should work with the SID, but that will fail with "No mapping between account names and security IDs was done."
# I really hate everything about this ...
username
=
windows_get_domain_and_name
()
for
cmd
in
(
[
'
icacls.exe
'
,
key_path
,
'
/Reset
'
],
[
'
icacls.exe
'
,
key_path
,
'
/Inheritance:r
'
],
[
'
icacls.exe
'
,
key_path
,
'
/Grant:r
'
,
f
'
{
username
}
:(R)
'
],
# for diagnostics
[
'
icacls.exe
'
,
key_path
],
):
cp
=
subprocess
.
run
(
cmd
,
stdin
=
subprocess
.
DEVNULL
,
stdout
=
subprocess
.
PIPE
,
stderr
=
subprocess
.
STDOUT
,
creationflags
=
SUBPROCESS_CREATION_FLAGS
,
text
=
True
)
if
cp
.
returncode
==
0
:
logger
.
debug
(
'
'
.
join
(
cmd
))
logger
.
debug
(
cp
.
stdout
.
strip
(
'
\n
'
))
else
:
logger
.
warning
(
'
'
.
join
(
cmd
))
logger
.
warning
(
cp
.
stdout
.
strip
(
'
\n
'
))
def
ensure_devkit_key
():
def
ensure_devkit_key
():
# this is called from threads and needs to be marshalled due to possible fs and permissions manipulations
# this is called from threads and needs to be marshalled due to possible fs and permissions manipulations
global
g_lock
global
g_lock
...
@@ -469,7 +503,12 @@ def ensure_devkit_key():
...
@@ -469,7 +503,12 @@ def ensure_devkit_key():
pubkey_path
=
os
.
path
.
join
(
key_folder
,
'
devkit_rsa.pub
'
)
pubkey_path
=
os
.
path
.
join
(
key_folder
,
'
devkit_rsa.pub
'
)
try
:
try
:
key
=
paramiko
.
RSAKey
.
from_private_key_file
(
key_path
)
key
=
paramiko
.
RSAKey
.
from_private_key_file
(
key_path
)
except
FileNotFoundError
:
except
PermissionError
as
e
:
logger
.
warning
(
e
)
logger
.
warning
(
'
Fix permissions and try paramiko key load again.
'
)
_fix_key_permissions
(
key_path
,
pubkey_path
)
key
=
paramiko
.
RSAKey
.
from_private_key_file
(
key_path
)
except
FileNotFoundError
as
e
:
# first time setup
# first time setup
logger
.
warning
(
f
'
{
key_path
}
not found - generating a new passwordless devkit key
'
)
logger
.
warning
(
f
'
{
key_path
}
not found - generating a new passwordless devkit key
'
)
os
.
makedirs
(
key_folder
,
exist_ok
=
True
)
os
.
makedirs
(
key_folder
,
exist_ok
=
True
)
...
@@ -481,37 +520,7 @@ def ensure_devkit_key():
...
@@ -481,37 +520,7 @@ def ensure_devkit_key():
key
.
write_private_key_file
(
key_path
)
key
.
write_private_key_file
(
key_path
)
o
=
open
(
pubkey_path
,
'
w
'
)
o
=
open
(
pubkey_path
,
'
w
'
)
o
.
write
(
get_public_key
(
key
))
o
.
write
(
get_public_key
(
key
))
if
platform
.
system
()
==
'
Linux
'
:
_fix_key_permissions
(
key_path
,
pubkey_path
)
# enforce/fix file permissions
os
.
chmod
(
key_path
,
0o400
)
os
.
chmod
(
pubkey_path
,
0o400
)
else
:
# fix permissions for private keys the windows way, keep ssh happy
# do not rely on get_username here, use the full domain\name of the current user - some systems fail if you just give username
# also icacls.exe docs suggest this should work with the SID, but that will fail with "No mapping between account names and security IDs was done."
# I really hate everything about this ...
username
=
windows_get_domain_and_name
()
for
cmd
in
(
[
'
icacls.exe
'
,
key_path
,
'
/Reset
'
],
[
'
icacls.exe
'
,
key_path
,
'
/Inheritance:r
'
],
[
'
icacls.exe
'
,
key_path
,
'
/Grant:r
'
,
f
'
{
username
}
:(R)
'
],
# for diagnostics
[
'
icacls.exe
'
,
key_path
],
):
cp
=
subprocess
.
run
(
cmd
,
stdin
=
subprocess
.
DEVNULL
,
stdout
=
subprocess
.
PIPE
,
stderr
=
subprocess
.
STDOUT
,
creationflags
=
SUBPROCESS_CREATION_FLAGS
,
text
=
True
)
if
cp
.
returncode
==
0
:
logger
.
debug
(
'
'
.
join
(
cmd
))
logger
.
debug
(
cp
.
stdout
.
strip
(
'
\n
'
))
else
:
logger
.
warning
(
'
'
.
join
(
cmd
))
logger
.
warning
(
cp
.
stdout
.
strip
(
'
\n
'
))
return
(
key
,
key_path
,
pubkey_path
)
return
(
key
,
key_path
,
pubkey_path
)
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment