[checkmk-commits] [tribe29/checkmk] 844deb: Restrict file permissions for ObjectStore loading

Branch: refs/heads/master Home: https://github.com/tribe29/checkmk Commit: 844deb26f802120b4736bdb73348e3ccb2833a28 https://github.com/tribe29/checkmk/commit/844deb26f802120b4736bdb73348e3ccb… Author: Hannes Rantzsch <hannes.rantzsch(a)tribe29.com> Date: 2022-07-11 (Mon, 11 Jul 2022) Changed paths: M cmk/gui/watolib/hosts_and_folders.py M cmk/utils/store/__init__.py M cmk/utils/store/_file.py M cmk/utils/store/_locks.py M cmk/utils/store/host_storage.py M tests/unit/cmk/utils/test_store.py Log Message: ----------- Restrict file permissions for ObjectStore loading * Prevent ObjectStore from loading world-writable files to mitigate the dangers of serializers that must not be used with untrusted files (such as pickle). * Fix leave_locked_unless_exception contextmanager to re-raise exceptions. * Move PickleSerializer closer to ObjectStore to discourage using it without the above mitigations. * Remove ObjectStore's unused interface to store files with permissions other than 0o660. Fixes CMK-10853. Change-Id: I22b0c2d38517669c9d1422224f420667a6553985