Project

General

Profile

Actions
Copy link

Bug #29682

open

It is possible to override the rudder node property with a String property, which cannot be modified or deleted

Bug #29682: It is possible to override the rudder node property with a String property, which cannot be modified or deleted

Added by Véronique HAYAERT 6 days ago. Updated 4 days ago.

Status:
Pending technical review
Priority:
0 (blocking)
Assignee:
Vincent MEMBRÉ
Category:
Web - Nodes & inventories
Target version:
9.1.5
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No

Description

I was able to add a "rudder" node property of type String on a node, which is not the expected type.
There are no modify or delete buttons, so this property cannot be modified or deleted from the webapp, which means this node is stuck with a node property of the wrong type that cannot be deleted.

This issue might also be present for other inherited node properties (e.g. rudder_auto_conditions, rudder_file_edit_header, and any other user-defined inherited node properties ). hence, we should :
A) verify whether it is possible to override them with an incorrect type, and
B) verify whether it is possible to delete the overriding property, especially if its type is not correct

I noticed this issue in a 9.2 instance, but it very well could be present in earlier versions

WORKAROUND: delete value by API: 

url -k -X POST -H "$(cat /var/rudder/run/api-token-header)" -H "Content-Type: application/json" 'https://localhost:8082/rudder/api/latest/nodes/<nodeid>' -d '{"properties":[{"name":"rudder","value":""}]}'

Files

clipboard-202609011503-uk1dc.png (62.6 KB) clipboard-202609011503-uk1dc.png Véronique HAYAERT, 2026-09-01 15:03
clipboard-202609011503-uk1dc.png

Updated by Véronique HAYAERT 6 days ago Actions
Copy link
 #1

  • Subject changed from It is possible to override the rudder node property with a String property, which cannot be deleted to It is possible to override the rudder node property with a String property, which cannot be modified or deleted
  • Description updated (diff)

Updated by Véronique HAYAERT 6 days ago Actions
Copy link
 #2

  • Priority changed from N/A to To review

Updated by Nicolas CHARLES 5 days ago Actions
Copy link
 #3

  • Assignee set to François ARMAND
  • Priority changed from To review to 0 (blocking)
  • Target version set to 9.0.10

the real issue is not that we can override, but it's that we can't fix afterward
MAYBE it is because rudder is a system variable

Updated by François ARMAND 4 days ago Actions
Copy link
 #4

  • Status changed from New to In progress

Updated by François ARMAND 4 days ago Actions
Copy link
 #5

  • Target version changed from 9.0.10 to 9.1.5

Updated by François ARMAND 4 days ago Actions
Copy link
 #6

  • Description updated (diff)

So, since that breaks thing on the agen (since at some point, we have hardecoded ${node.properties[rudder][server][cf_serverd_bind_address]} in some policies), I'm wondering if we shouldn't at least forbied anything but JSON type for that property.

Updated by François ARMAND 4 days ago Actions
Copy link
 #7

So, on that case, we are linking the parent property provider, which is a system one forbidding write.
We should:
- never forbid write on an override we did,
- not use that property provider, that's doesn't make sense.

Updated by François ARMAND 4 days ago Actions
Copy link
 #8

  • Status changed from In progress to Pending technical review
  • Assignee changed from François ARMAND to Vincent MEMBRÉ
  • Pull Request set to https://github.com/Normation/rudder/pull/7466
Actions
Copy link

Also available in: PDF Atom