From 63fc1ffd0e6050b8a7bc47776ed0513b15aaf7d5 Mon Sep 17 00:00:00 2001 From: L0m1g Date: Sat, 3 May 2025 16:11:28 +0200 Subject: [PATCH] Fix: unlock database --- .gitignore | 1 + Dockerfile | 4 +++- erminig/models/db.py | 8 ++++++++ erminig/system/security.py | 11 +++++------ lib/erminig.db | Bin 49152 -> 0 bytes 5 files changed, 17 insertions(+), 7 deletions(-) delete mode 100644 lib/erminig.db diff --git a/.gitignore b/.gitignore index 9f81dd8..cefb59e 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ __pycache__/ *.egg-info/ .pytest_cache/ *.log +lib/erminig.db diff --git a/Dockerfile b/Dockerfile index 508e3c8..6e6c1eb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,9 @@ RUN dnf -y update && \ dnf -y install python3 python3-pip sqlite tar zstd git bash && \ dnf clean all -RUN mkdir -p /var/lib/erminig /var/cache/erminig /opt/erminig +RUN useradd -r -s /sbin/nologin -d /var/lib/erminig pak && \ + mkdir -p /var/lib/erminig /var/cache/erminig /opt/erminig && \ + chown -R pak:pak /var/lib/erminig /var/cache/erminig /opt/erminig COPY . /opt/erminig diff --git a/erminig/models/db.py b/erminig/models/db.py index dde81c8..3fd0cc9 100644 --- a/erminig/models/db.py +++ b/erminig/models/db.py @@ -7,6 +7,8 @@ # Libre comme l’air, stable comme un menhir, et salé comme le beurre. # +import os +import pwd import sqlite3 from erminig.config import Config @@ -20,6 +22,12 @@ def init_db(): conn.executescript(f.read()) conn.commit() conn.close() + # Attribution au user pak + pak_uid = pwd.getpwnam("pak").pw_uid + pak_gid = pwd.getpwnam("pak").pw_gid + os.chown(Config.DB_PATH, pak_uid, pak_gid) + os.chmod(Config.DB_PATH, 0o664) + print("Base erminig.db initialisée avec succès.") diff --git a/erminig/system/security.py b/erminig/system/security.py index a2ff43d..98bc2f1 100644 --- a/erminig/system/security.py +++ b/erminig/system/security.py @@ -39,9 +39,9 @@ def run_as_user(username): try: pid = os.fork() if pid > 0: - # Parent + # Parent : attendre le child, ne pas exit, juste return proprement _, status = os.waitpid(pid, 0) - return os.WEXITSTATUS(status) + return status >> 8 # récupère le code retour du fils (comme exit code) # Child pw_record = pwd.getpwnam(username) @@ -51,14 +51,13 @@ def run_as_user(username): os.setgid(user_gid) os.setuid(user_uid) - # Exécuter la fonction sous l'utilisateur demandé result = func(*args, **kwargs) - sys.exit(0 if result is None else int(bool(result))) + os._exit(0 if result is None else int(bool(result))) except OSError as e: print(f"[SECURITY] Fork échoué : {e}") - sys.exit(1) + os._exit(1) return wrapper - return decorator + return decorator \ No newline at end of file diff --git a/lib/erminig.db b/lib/erminig.db deleted file mode 100644 index 25fdf4972ca3abcb1e03e9f4b74d49d1e963a6c0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 49152 zcmWFz^vNtqRY=P(%1ta$FlG>7U}R))P*7lCVBlt8VBldu01gHQ1{MUDff0#~i^>HJ5?+DgRO4$vn;6+B`v=k2s3hGg%+8=Hk*iDn1$lqaiRF0>dZ-in-av zO=TGy6*KcvQY$i3D&k8Eic5-86LaIsQj3Z+^YfroF^_YQt7C|(La3i-V5qBtr=N>! zgaS4V3jTfyFije8(=tgtTG?j?yyIjMR1C7EfN$%!SI`FX`C9B!zc zA&yQyt_mnp3L0Dr3JMCDDGHu`A+GMOK?(sup1zJjkqX|fkqVBXA^x6z&Oxreu6`jp zV3m1^xv2^vt`Q*$e*Pf}exW`-5OJteu}PH{nP~zBJ8bHZu|ssA7bKQsfWsCNJ&7qPM0*LM!_7a))zjS%oDMV)F40s7a&>bJ za`kg|4OV~(7i(muXmV*b<#Mo#OG+}fnt}r&sWdYur5HkTq67v+jIO~^lvvH)6MK!O&` z2M26XX?ToVkBpzCTFX|!j;q@frKrJE`cWdVn4b1pbs zVWz=oR+MmsiINA}yX8NkdYuC2`&2@VZt z02ZefmZs(5H|LRwB~g+fqpFu3Y205t}R@*oa{ zRoUP+3f!om)b!K}g#u8!z#}9i0AwOe7u4k9OogP>;{41!u#st*Igs)T-mCz%O#BN# zt*pG%90ehD~0srWL=eNXsWB#D@iQUtEd8-Mp{ba(llgZ z6L*!zmF3{k8E*(@GBYqRfcos^Vef{K=JUxi0UVc%!enDxHK3J(f zL{PuXOs@hWq8n|XYZ=!-QC6IjL0Gg=+0ooMJsBe~a|<$cGxO5) zatqS+Qd0GEGmDDyi;DF@*aHN(dB; zuFed`phgrZ2tgPWjETi1MfrJp$@#h9niM3h4kBZxU4*}C>31Mf>JO{nSL}%>p>qTj^3V3 zsxrc2ZKD()Cxg6bBe%7)ajH>TaY0djI!gTxYEM8~EO47qnlS~b`2{(t`X!Ym#rgVh z6ZFeaT?NZea0TeD!3q9)U3qxyi!mS z0bx*D#IP5lL?5b@TstecVZKeyFG|Ho0_e8F73srS-QdmyutdSd^lll#C@BGFd@oCaAHSlvtbr3K9^;8Z3#$8Tuea{O6dAdJmAm>PW;gKTS=k*!V6&%@h91la~s1GW~#AlKRoCQ!iUhBFu^mXx6M zu~PEO^K$YNQ}l`x%M$bQ5;NdU3wV|DUgpf&VA}2mZ(W*Z9x!ALHN2zn*_7|7`wV{zm>{{#5=5em{O^ zek*<*er0|senEateg?iTe6RQ(@!jA%&v%q>58r0KWqdRE>iGIGI?ba3qaiRF0;3@? z8UmvsFd71*Aut*OqaiRF0;3@?8Umvsz#zb^$_O4=gwCa^a4?H9g61rhd70%I;nRvr zJj}9;u(>})kQ&hRodTFqRGK8u$t=zYp7@f32&ERtf`vd+Ml$To!i?#;1=3&<&;XYd zH?uS&bQ(kwtRW>SR|2doIawSmkXW8A24aAQ*F_~Vt(1CPUTfmq-XG)^!J zG!(`GvH&*n#LmVn$e5JO267T;tcMjO2^tdt4cD;1IG}M6W{?ul5Csz(voL33at>(z zpNao51OG?<$D;{yGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnho8h5!!} zvn(TYn?bP(FC()&BYYo#3aJ0D!py?JzkuJC?*-pvJ}2JmyiL4@JU4kVc!at4ai?=V z<7(j&_wbqfhtEp9V|71tV72IerMA&V8k3xiSjg&>x9!&Xh{!}P-Uj_ATfaN2C>EziclD4K4pV5nyZ zj{2<&ihxw%G|V7SmW_c?GT&IvP|wI1HK8JJ z$N>+AL-&F}RN^+$TL$7jS!2BJgYEYKslsEJG$^!WdFXx)V?ASB zh8bFVOMy~qs29SE3#+n54fD&`5F^{318SVlXI=u+rs{mGv$53ui8D443ZK(&ZanTD7_$;M9 zoTY22XO7#@d@gVdXc}`F=oy+KVgNN=fu}nmn-8!gDu_;qv@V2$+rltTHU>uVYGY1A zJp(-pSdfDv9800NsrMR*2I;qhNMW z(kM4(H_|hKmwcG!K{g~HHXDFc<2E#t4Vw;9{ zF_al%D6^5CInGuX$WYKMIoMDT15|Pu;Wjjp2^`A&#!NwS^d3H-;RdBXb6mkz-S1JhQMeDjE2By z2#kinXb6mkz-S1JhQLS*0nq;c(ffg~27!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=Ckr)D_ z{r`~|>!W@i4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5EyA8FxvkgX)!+P-_Z~l z4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!84u7y_gH|B)E$qkbL@fzc2c4S~@R7!85Z z5Eu=C(GVC7fzc2c4S~@R7-=B@I{#0FFM@&p8~-c*`}|k ze-?i%e;~grzXiW8zaqaVKL_6*z6idLe9!o9^PT5A%D0PeE#D%(>3ki0b$ms9sUt1? zM*TY)0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UiCd1bA2&B^jaDX{&%a&>O9lxmg&+ z86lTXD{-{@vSM^GOncypS#leap7vze8jfP%sD+-o?TtzDaWKOa$l+dm<_qelpm}JdgUk|STp$kPhPMZ$eo=$V7G&=+T;eS zhF*`!1y%yNyOI;khTJ#F0X7AERU|uD7;?WO8(1&&21Zt}8u0CjEMO-1&O>Ifa>zx6 NOq?v7;+)`{0RfsTR1p9G