mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
1227674d8f
- Computes API: mark password as write_only in ComputeSerializer, restrict ComputeViewSet and architectures to IsAdminUser. - Instances API: enforce user ownership tenant isolation in InstanceViewSet.list, restrict MigrateViewSet and CreateInstanceViewSet to IsAdminUser, require IsAdminUser for mutating FlavorViewSet. - Storage, Network, and Interface APIs: restrict StorageViewSet, VolumeViewSet, NetworkViewSet, InterfaceViewSet to IsAdminUser. - AppSettings & NWFilters: protect appsettings and nwfilter views with @superuser_only (403 Forbidden for non-superusers). - noVNC Console: sign tokens with TimestampSigner (salt='console.novnc', max_age=600), verify signature and user authorization in novncd with backward-compatible fallback for debug/test mode. - Accounts: avoid hardcoded default admin password; generate cryptographically secure random password unless ADMIN_PASSWORD is set (preserve 'admin' in test runner). - gstfsd daemon: bind to 127.0.0.1 by default instead of 0.0.0.0. - Tests: added comprehensive test coverage for API security, token expiration/rejection, and view permissions (132 tests passing).
60 lines
2.2 KiB
Python
60 lines
2.2 KiB
Python
#!/usr/bin/env python
|
|
#
|
|
# gstfsd - WebVirtCloud daemon for managing VM's filesystem
|
|
#
|
|
|
|
import os
|
|
import socketserver
|
|
import json
|
|
import guestfs
|
|
import re
|
|
|
|
PORT = int(os.environ.get("GSTFSD_PORT", 16510))
|
|
ADDRESS = os.environ.get("GSTFSD_BIND_HOST", "127.0.0.1")
|
|
|
|
|
|
class MyTCPServer(socketserver.ThreadingTCPServer):
|
|
allow_reuse_address = True
|
|
|
|
|
|
class MyTCPServerHandler(socketserver.BaseRequestHandler):
|
|
def handle(self):
|
|
# recive data
|
|
d = self.request.recv(1024).strip()
|
|
data = json.loads(d)
|
|
|
|
# GuestFS
|
|
gfs = guestfs.GuestFS(python_return_dict=True)
|
|
try:
|
|
gfs.add_domain(data['vname'])
|
|
gfs.launch()
|
|
parts = gfs.list_partitions()
|
|
for part in parts:
|
|
try:
|
|
gfs.mount(part, '/')
|
|
if gfs.is_file('/etc/shadow'):
|
|
if data['action'] == 'password':
|
|
file_shadow = gfs.cat('/etc/shadow')
|
|
new_root_hash = "root:" + data['passwd'] + ":"
|
|
file_shadow_new = re.sub('^root:.*?:', new_root_hash, file_shadow)
|
|
gfs.write('/etc/shadow', file_shadow_new)
|
|
gfs.chmod(640, '/etc/shadow')
|
|
self.request.sendall(json.dumps({'return': 'success'}))
|
|
if data['action'] == 'publickey':
|
|
if not gfs.is_dir('/root/.ssh'):
|
|
gfs.mkdir('/root/.ssh')
|
|
gfs.chmod(700, "/root/.ssh")
|
|
gfs.write('/root/.ssh/authorized_keys', data['key'])
|
|
gfs.chmod(600, '/root/.ssh/authorized_keys')
|
|
self.request.sendall(json.dumps({'return': 'success'}))
|
|
gfs.umount(part)
|
|
except RuntimeError:
|
|
pass
|
|
gfs.shutdown()
|
|
gfs.close()
|
|
except Exception as err:
|
|
self.request.sendall(bytes(json.dumps({'return': 'error', 'message': str(err)}).encode()))
|
|
|
|
|
|
server = MyTCPServer((ADDRESS, PORT), MyTCPServerHandler)
|
|
server.serve_forever()
|