From 373d1dc0926111e742ae74b41e69d501a3161d3f Mon Sep 17 00:00:00 2001
From: Kashyap Chamarthy <kchamart@redhat.com>
Date: Tue, 28 Nov 2017 18:16:28 +0100
Subject: [PATCH] Use 'mkstemp' to avoid predictable temp file names

Use Python's 'mkstemp'[1] to securely create temporary files, and avoid
some common mistakes[2] when using temporary files.

This way, we can avoid temporary file names like: /tmp/qemu-kernel.

With this patch, when you run the tool:

  $> .ovmf-vars-generator.py output-VARS.fd --verbose
  Downloading https://$LONG_URL/vmlinuz to /var/tmp/tmpR0H1nf.kernel
  Downloading https://$LONG_URL/initrd.img to /var/tmp/tmpUksXt1.initrd
  Confirmed: Secure Boot enabled!
  Created and verified output-VARS.fd

While at it, clean up the temporary files, so that we don't leave "test
turds" around.

[1] https://docs.python.org/3/library/tempfile.html#tempfile.mkstemp
[2] http://www.linuxsecurity.com/content/view/115462/151/

Suggested-by:  Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
---
 ovmf-vars-generator.py | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/ovmf-vars-generator.py b/ovmf-vars-generator.py
index 86e627c5a6bd73cfab00e0ff199b58d0921e4714..b3a7e0cfeee63d1f0e07c5b82926f855ce2c6935 100755
--- a/ovmf-vars-generator.py
+++ b/ovmf-vars-generator.py
@@ -1,14 +1,15 @@
 #!/bin/python
 # Copyright (C) 2017 Red Hat
-# Authors: 
+# Authors:
 # - Patrick Uiterwijk <puiterwijk@redhat.com>
 # - Kashyap Chamarthy <kchamart@redhat.com>
 #
 # Licensed under MIT License, for full text see LICENSE
 #
-# Purpose: Launch a QEMU guest and enroll UEFI keys into an OVMF VARS file.
-#          Then, boot a Kernel and initrd with QEMU, and verify if
-#          Secure Boot is enabled.
+# Purpose: Launch a QEMU guest and enroll ithe UEFI keys into an OVMF
+#          variables ("VARS") file.  Then boot a Linux kernel and initrd
+#          with QEMU.  Finally, perform a check to verify if Secure Boot
+#          is enabled.
 
 from __future__ import print_function
 
@@ -17,7 +18,7 @@ import os
 import shutil
 import string
 import subprocess
-
+import tempfile
 
 def strip_special(line):
     return ''.join([c for c in line if c in string.printable])
@@ -47,14 +48,12 @@ def generate_qemu_cmd(args, readonly, *extra_args):
 
 
 def download(url, target, verbose):
-    if os.path.exists(target):
-        return
     import requests
     if verbose:
         print('Downloading %s to %s' % (url, target))
     r = requests.get(url, stream=True)
     with open(target, 'wb') as f:
-        for chunk in r.iter_content(chunk_size=1024): 
+        for chunk in r.iter_content(chunk_size=1024):
             if chunk:
                 f.write(chunk)
 
@@ -75,12 +74,15 @@ def enroll_keys(args):
         stdin=subprocess.PIPE,
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE)
-    # Wait until the shell starts (First line printed)
+    # Wait until the UEFI shell starts (first line is printed)
     read = p.stdout.readline()
     if args.print_output:
         print(strip_special(read), end='')
-    # Send escape to enter shell early
+    # Send escape char to enter the UEFI shell early
     p.stdin.write(chr(27))
+    # And then run the following three commands from the UEFI shell:
+    # change into the first file system device; install the default
+    # keys and certificates, and reboot
     p.stdin.write(b'fs0:\r\n')
     p.stdin.write(b'EnrollDefaultKeys.efi\r\n')
     p.stdin.write(b'reset\r\n')
@@ -96,11 +98,18 @@ def enroll_keys(args):
 
 
 def test_keys(args):
-    kernel = '/tmp/qemu-kernel'
-    initrd = '/tmp/qemu-initrd'
+    try:
+        TMPDIR = '/var/tmp/'
 
-    download(args.kernel_url, kernel, args.verbose)
-    download(args.initrd_url, initrd, args.verbose)
+        fd, kernel = tempfile.mkstemp(suffix=".kernel", dir=TMPDIR)
+        download(args.kernel_url, kernel, args.verbose)
+
+        fd, initrd = tempfile.mkstemp(suffix=".initrd", dir=TMPDIR)
+        download(args.initrd_url, initrd, args.verbose)
+
+    except:
+        os.remove(kernel)
+        os.remove(initrd)
 
     cmd = generate_qemu_cmd(
         args,
-- 
2.9.5

