diff options
| author | Varun Varma <varun.varma@canonical.com> | 2026-05-14 17:20:28 +0200 |
|---|---|---|
| committer | Julian Andres Klode <jak@debian.org> | 2026-05-17 18:53:31 +0000 |
| commit | 45f1fd73d0b62ce6422365a935abc317718ea142 (patch) | |
| tree | 7c71a2aa92ca07d49990230a67f56d1b5ee634e2 /methods | |
| parent | 1514ddad0e542c325c55c93866507dcc96ff5c29 (diff) | |
Warn if auth.conf is unreadable (LP: #2150631)
LP: #2150631 is a bug where trying to access an authentication-locked repo without root sends a 401 error, which is misleading since the authentication information could be in auth.conf.d, but just inaccessible without root. This adds a warning in that scenario, as well as an integration test.
Diffstat (limited to 'methods')
| -rw-r--r-- | methods/aptmethod.h | 15 | ||||
| -rw-r--r-- | methods/basehttp.cc | 12 |
2 files changed, 27 insertions, 0 deletions
diff --git a/methods/aptmethod.h b/methods/aptmethod.h index f564499f0..9499367c8 100644 --- a/methods/aptmethod.h +++ b/methods/aptmethod.h @@ -539,6 +539,9 @@ class aptAuthConfMethod : public aptMethod { std::vector<std::unique_ptr<FileFd>> authconfs; + protected: + std::vector<std::string> inaccessibleAuthConfs; + public: bool Configuration(std::string Message) override { @@ -555,6 +558,12 @@ class aptAuthConfMethod : public aptMethod { authconfs.emplace_back(new FileFd()); authconfs.back()->Open(netrc, FileFd::ReadOnly); + if (authconfs.back()->IsOpen() == false) + { + struct stat st; + if (stat(netrc.c_str(), &st) == 0) + inaccessibleAuthConfs.push_back(netrc); + } } auto const netrcparts = _config->FindDir("Dir::Etc::netrcparts"); @@ -564,6 +573,12 @@ class aptAuthConfMethod : public aptMethod { authconfs.emplace_back(new FileFd()); authconfs.back()->Open(netrcpart, FileFd::ReadOnly); + if (authconfs.back()->IsOpen() == false) + { + struct stat st; + if (stat(netrcpart.c_str(), &st) == 0) + inaccessibleAuthConfs.push_back(netrcpart); + } } } _error->RevertToStack(); diff --git a/methods/basehttp.cc b/methods/basehttp.cc index db0ed228f..8dd596f8f 100644 --- a/methods/basehttp.cc +++ b/methods/basehttp.cc @@ -506,6 +506,18 @@ BaseHttpMethod::DealWithHeaders(FetchResult &Res, RequestState &Req) std::string err; strprintf(err, "HttpError%u", Req.Result); SetFailReason(err); + if (Req.Result == 401 && inaccessibleAuthConfs.empty() == false) + { + std::string conflist; + std::string msg; + for (auto const &path : inaccessibleAuthConfs) + conflist += (conflist.empty() ? "" : ", ") + path; + strprintf(msg, _("Authentication credentials may be configured in %s, " + "but the file(s) are not readable by the current user. " + "Try running this command as root."), + conflist.c_str()); + Warning(std::move(msg)); + } _error->Error("%u %s", Req.Result, Req.Code); } if (Req.haveContent == HaveContent::TRI_TRUE) |