Commit c42262b4 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Merge branch 'backup-permissions' into 'master'

Change permissions on backup files

Use more restrictive permissions for backup tar files and for the db, uploads, and repositories directories inside the tar files.  See #1894.  Now the backup task recursively `chmod`s the `db/`, `uploads/`, and `repositories/` folders with 0700 permissions, and the tar file is created as 0600.

cc @sytse

See merge request !1703
parents c6586b12 8587a293
...@@ -32,6 +32,7 @@ v 7.9.0 (unreleased) ...@@ -32,6 +32,7 @@ v 7.9.0 (unreleased)
- Add a service to send updates to an Irker gateway (Romain Coltel) - Add a service to send updates to an Irker gateway (Romain Coltel)
- Add brakeman (security scanner for Ruby on Rails) - Add brakeman (security scanner for Ruby on Rails)
- Slack username and channel options - Slack username and channel options
- Restrict permissions on backup files
- Add grouped milestones from all projects to dashboard. - Add grouped milestones from all projects to dashboard.
- Web hook sends pusher email as well as commiter - Web hook sends pusher email as well as commiter
- Add Bitbucket omniauth provider. - Add Bitbucket omniauth provider.
......
...@@ -17,14 +17,18 @@ module Backup ...@@ -17,14 +17,18 @@ module Backup
file << s.to_yaml.gsub(/^---\n/,'') file << s.to_yaml.gsub(/^---\n/,'')
end end
FileUtils.chmod_R(0700, %w{db uploads repositories})
# create archive # create archive
$progress.print "Creating backup archive: #{tar_file} ... " $progress.print "Creating backup archive: #{tar_file} ... "
orig_umask = File.umask(0077)
if Kernel.system('tar', '-cf', tar_file, *BACKUP_CONTENTS) if Kernel.system('tar', '-cf', tar_file, *BACKUP_CONTENTS)
$progress.puts "done".green $progress.puts "done".green
else else
puts "creating archive #{tar_file} failed".red puts "creating archive #{tar_file} failed".red
abort 'Backup failed' abort 'Backup failed'
end end
File.umask(orig_umask)
upload(tar_file) upload(tar_file)
end end
......
...@@ -10,17 +10,17 @@ describe 'gitlab:app namespace rake task' do ...@@ -10,17 +10,17 @@ describe 'gitlab:app namespace rake task' do
Rake::Task.define_task :environment Rake::Task.define_task :environment
end end
def run_rake_task(task_name)
Rake::Task[task_name].reenable
Rake.application.invoke_task task_name
end
describe 'backup_restore' do describe 'backup_restore' do
before do before do
# avoid writing task output to spec progress # avoid writing task output to spec progress
allow($stdout).to receive :write allow($stdout).to receive :write
end end
let :run_rake_task do
Rake::Task["gitlab:backup:restore"].reenable
Rake.application.invoke_task "gitlab:backup:restore"
end
context 'gitlab version' do context 'gitlab version' do
before do before do
Dir.stub glob: [] Dir.stub glob: []
...@@ -36,7 +36,9 @@ describe 'gitlab:app namespace rake task' do ...@@ -36,7 +36,9 @@ describe 'gitlab:app namespace rake task' do
it 'should fail on mismatch' do it 'should fail on mismatch' do
YAML.stub load_file: {gitlab_version: "not #{gitlab_version}" } YAML.stub load_file: {gitlab_version: "not #{gitlab_version}" }
expect { run_rake_task }.to raise_error SystemExit expect { run_rake_task('gitlab:backup:restore') }.to(
raise_error SystemExit
)
end end
it 'should invoke restoration on mach' do it 'should invoke restoration on mach' do
...@@ -44,9 +46,43 @@ describe 'gitlab:app namespace rake task' do ...@@ -44,9 +46,43 @@ describe 'gitlab:app namespace rake task' do
expect(Rake::Task["gitlab:backup:db:restore"]).to receive :invoke expect(Rake::Task["gitlab:backup:db:restore"]).to receive :invoke
expect(Rake::Task["gitlab:backup:repo:restore"]).to receive :invoke expect(Rake::Task["gitlab:backup:repo:restore"]).to receive :invoke
expect(Rake::Task["gitlab:shell:setup"]).to receive :invoke expect(Rake::Task["gitlab:shell:setup"]).to receive :invoke
expect { run_rake_task }.to_not raise_error expect { run_rake_task('gitlab:backup:restore') }.to_not raise_error
end end
end end
end # backup_restore task end # backup_restore task
describe 'backup_create' do
def tars_glob
Dir.glob(File.join(Gitlab.config.backup.path, '*_gitlab_backup.tar'))
end
before :all do
FileUtils.rm(tars_glob)
orig_stdout = $stdout
$stdout = StringIO.new
run_rake_task('gitlab:backup:create')
$stdout = orig_stdout
@backup_tar = tars_glob.first
end
before do
backup_path = File.join(Gitlab.config.backup.path, 'test')
allow(Gitlab.config.backup).to receive(:path).and_return(backup_path)
end
it 'should set correct permissions on the tar file' do
expect(File.exist?(@backup_tar)).to be_truthy
expect(File::Stat.new(@backup_tar).mode.to_s(8)).to eq('100600')
end
it 'should set correct permissions on the tar contents' do
tar_contents, exit_status = Gitlab::Popen.popen(
%W{tar -tvf #{@backup_tar} db uploads repositories}
)
expect(exit_status).to eq(0)
expect(tar_contents).not_to match(/^.{4,9}[rwx]/)
end
end # backup_create task
end # gitlab:app namespace end # gitlab:app namespace
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment