Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-120273

Harden subscription-manager to use system python modules

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • None
    • None
    • rhel-upgrades
    • 12
    • 0
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • RegressionOnly
    • None

      Python applications provided by RH in RHEL should be hardened so they are not negatively impacted by custom python modules installed on system. Installing upstream initparse version 0.4.0 on RHEL breaks subscription-manager fundamentally. Try:

      Reproducer:

      # pip3.6 install iniparse==0.4 --ignore-installed
      WARNING: Running pip install with root privileges is generally not a good idea. Try `pip3.6 install --user` instead.
      Collecting iniparse==0.4
        Using cached https://files.pythonhosted.org/packages/0f/d1/3090ef9be165da5ddb1b0cf2b332d3282588bdd2dd0967e94b547f10055f/iniparse-0.4.tar.gz
      Installing collected packages: iniparse
        Running setup.py install for iniparse ... done
      Successfully installed iniparse-0.4
      
      # subscription-manager 
      Unable to find Subscription Manager module.
      Error: No module named 'ini'
      

      This is especially visible for systems upgrading between RHEL versions using leapp, where users could install specific python modules using pip for alternative python version (not the platform one) e.g. because of RHEL does not provide an RPM with such a python module for alternative versions of python. But this issue is generic and it is not limited to in-place upgrades - as shown in example above.

      I expect that similar problems are for RHSM in RHEL 10 as well. Please update the shebang, using `-s` option (or -sP options rather) to load only system python modules.

      Additional info:

              csi-client-tools-bugs CSI Client Tools Bugs Bot
              pstodulk@redhat.com Petr Stodulka
              leapp-notifications leapp-notifications
              RHEL Upgrades QE Team RHEL Upgrades QE Team
              Miriam Portman Miriam Portman
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: