Fix various issues in the tar based distribution validation logic (#12716)
* Fix various issues in the tar based distribution validation logic * Add more fixes
Blue committed
Mar 19, 2025 at 13:14 UTC
096844a47186e3083fa8085b862296cbea3b10c3
1 file changed
+18
-9
distributions/validate-modern.py
+18
-9
@@ -14,6 +14,8 @@ from github import Github
14
15
16
USR_LIB_WSL = '/usr/lib/wsl'
17
+USR_LIBEXEC_WSL = '/usr/libexec/wsl'
18
+USR_SHARE_WSL = '/usr/share/wsl'
19
20
MAGIC = magic.Magic()
21
X64_ELF_MAGIC = re.compile('^ELF 64-bit.* x86-64, version 1')
@@ -380,14 +382,14 @@ def read_tar(node, file, elf_magic: str):
382
return keys
383
384
defaultUid = None
383
- if validate_mode('/etc/wsl-distribution.conf', [oct(0o664), oct(0o644)], 0, 0):
385
+ if validate_mode('/etc/wsl-distribution.conf', [oct(0o664), oct(0o644)], 0, 0, follow_symlink=True):
386
config = validate_config('/etc/wsl-distribution.conf', ['oobe.command', 'oobe.defaultuid', 'shortcut.icon', 'oobe.defaultname', 'windowsterminal.profiletemplate'])
387
388
if oobe_command := config.get('oobe.command', None):
389
validate_mode(oobe_command, [oct(0o775), oct(0o755)], 0, 0)
390
389
- if not oobe_command.startswith(USR_LIB_WSL):
390
- warning(node, f'value for oobe.command is not under {USR_LIB_WSL}: "{oobe_command}"')
391
+ if not oobe_command.startswith(USR_LIB_WSL) and not oobe_command.startswith(USR_LIBEXEC_WSL):
392
+ warning(node, f'value for oobe.command is not under {USR_LIB_WSL} or {USR_LIBEXEC_WSL}: "{oobe_command}"')
393
394
if defaultUid := config.get('oobe.defaultuid', None):
395
if defaultUid != '1000':
@@ -398,8 +400,10 @@ def read_tar(node, file, elf_magic: str):
400
if shortcut_icon := config.get('shortcut.icon', None):
401
validate_mode(shortcut_icon, [oct(0o664), oct(0o644)], 0, 0, 1024 * 1024)
402
401
- if not shortcut_icon.startswith(USR_LIB_WSL):
402
- warning(node, f'value for shortcut.icon is not under {USR_LIB_WSL}: "{shortcut_icon}"')
403
+ if not shortcut_icon.startswith(USR_LIB_WSL) and not shortcut_icon.startswith(USR_SHARE_WSL):
404
+ warning(node, f'value for shortcut.icon is not under {USR_LIB_WSL} or {USR_SHARE_WSL}: "{shortcut_icon}"')
405
+ else:
406
+ warning(node, 'No shortcut.icon provided')
407
408
if terminal_profile := config.get('windowsterminal.profileTemplate', None):
409
validate_mode(terminal_profile, [oct(0o660), oct(0o640)], 0, 0, 1024 * 1024)
@@ -407,13 +411,13 @@ def read_tar(node, file, elf_magic: str):
411
if not terminal_profile.startswith(USR_LIB_WSL):
412
warning(node, f'value for windowsterminal.profileTemplate is not under {USR_LIB_WSL}: "{terminal_profile}"')
413
410
- if validate_mode('/etc/wsl.conf', [oct(0o664), oct(0o644)], 0, 0, optional=True):
414
+ if validate_mode('/etc/wsl.conf', [oct(0o664), oct(0o644)], 0, 0, optional=True, follow_symlink=True):
415
config = validate_config('/etc/wsl.conf', ['boot.systemd'])
416
if config.get('boot.systemd', False):
417
validate_mode('/sbin/init', [oct(0o775), oct(0o755)], 0, 0, magic=elf_magic, follow_symlink=True)
418
419
validate_mode('/etc/passwd', [oct(0o664), oct(0o644)], 0, 0, parse_method = lambda fd: read_passwd(node, defaultUid, fd))
416
- validate_mode('/etc/shadow', [oct(0o640), oct(0o600)], 0, None)
420
+ validate_mode('/etc/shadow', [oct(0o640), oct(0o600), oct(0)], 0, None)
421
validate_mode('/bin/bash', [oct(0o755), oct(0o775)], 0, 0, magic=elf_magic, follow_symlink=True)
422
validate_mode('/bin/sh', [oct(0o755), oct(0o775)], 0, 0, magic=elf_magic, follow_symlink=True)
423
@@ -446,7 +450,12 @@ def read_url(url: dict, elf_magic):
450
read_tar(url, fd, elf_magic)
451
else:
452
with requests.get(address, stream=True) as response:
449
- response.raise_for_status()
453
+
454
+ try:
455
+ response.raise_for_status()
456
+ except Exception as e:
457
+ error(url, str(e))
458
+ return
459
460
with tempfile.NamedTemporaryFile() as file:
461
for e in response.iter_content(chunk_size=4096 * 4096):
@@ -492,7 +501,7 @@ def error(node, message: str):
501
502
def warning(node, message: str):
503
if node is None:
495
- click.secho(f'Error: {message}', fg='red')
504
+ click.secho(f'Warning: {message}', fg='yellow')
505
else:
506
global warnings
507