Bug #5632
closed
Permissions may be applied recursively even if not asked to by "filesPermissions" Technique
Added by Florian Heigl about 10 years ago. Updated almost 10 years ago.
Description
We made a sanity technique that should employ basic parameters like correct permissions on most critical files/directories.
This technique is attached.
No directories there are configured to be recursed.
It starts being processed at / and the proceeds to /var. when processing /var it switches recursion on.
technique was updated to 1.1, no change.
I'll update with more info, but the basic thing is:
the permlist sets recursion = no.
Not sure how it gets overridden.
Files
| permlist (3 KB) permlist | Florian Heigl, 2014-10-09 19:20 | ||
| filesPermissions.cf (9.74 KB) filesPermissions.cf | Florian Heigl, 2014-10-09 19:20 | ||
| Rudder_-_Directives_Management.jpg (62.1 KB) Rudder_-_Directives_Management.jpg | Florian Heigl, 2014-10-09 19:20 |
Updated by Florian Heigl about 10 years ago
In verbose mode I was able to single out this message:
/default/files_permissions/methods/'any'/default/check_permissions/classes/'edit_recurse'[0]: Adding local bundle class 'edit_recurse'
The same did not happen for the directory / before this one, nor, as far as I could see for the next one.
I'll prepare some smart'ly grepped log to give info on this.
As far as I can see the whole of /inputs contains no deeply confidential info, so I can provide that via mail.
Updated by Florian Heigl about 10 years ago
Amazingly this does not happen in tiny home lab, only in big other lab.
Both SLES & technique version 1.1, but also a few differences. Not sure if i can i.e. transfer the cfengine folder and test on the currently fine system?
Updated by Florian Heigl about 10 years ago
Output showing the actual behaviour:
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'file_exists'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'file_exists'[0]: Adding local bundle class 'file_exists'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'user_absent'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'group_absent'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'edit_owner'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'edit_owner'[0]: Adding local bundle class 'edit_owner'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'edit_group'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'edit_group'[0]: Adding local bundle class 'edit_group'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'edit_mode'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'edit_mode'[0]: Adding local bundle class 'edit_mode'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'edit_recurse'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'edit_recurse'[0]: Adding local bundle class 'edit_recurse'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'enable_suid'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'enable_sgid'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'is_symlink'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'classes_defined'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'classes_defined'[0]: Adding local bundle class 'classes_defined'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes: Evaluating promise 'can_edit_suid_sgid'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/classes/'can_edit_suid_sgid'[0]: Adding local bundle class 'can_edit_suid_sgid'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Evaluating promise 'identifier'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Evaluating promise 'extended_modes'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Skipping next promise 'extended_modes', as context 'classes_defined.enable_suid.!enable_sgid' is not relevant
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Evaluating promise 'extended_modes'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Skipping next promise 'extended_modes', as context 'classes_defined.!enable_suid.enable_sgid' is not relevant
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Evaluating promise 'extended_modes'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Skipping next promise 'extended_modes', as context 'classes_defined.enable_suid.enable_sgid' is not relevant
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/vars: Evaluating promise 'extended_modes'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions: Private classes augmented: file_exists edit_owner edit_group edit_recurse classes_defined edit_mode can_edit_suid_sgid
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Evaluating promise '${fileName}'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Skipping next promise '${fileName}', as context 'file_exists.edit_owner.!user_absent.!edit_recurse.!is_symlink' is not re
levant
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Evaluating promise '${fileName}'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Skipping next promise '${fileName}', as context 'file_exists.edit_group.!group_absent.!edit_recurse.!is_symlink' is not r
elevant
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Evaluating promise '${fileName}'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Skipping next promise '${fileName}', as context 'can_edit_suid_sgid.file_exists.edit_mode.!edit_recurse.!is_symlink' is n
ot relevant
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files: Evaluating promise '${fileName}'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Comment 'Setting the file owner'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Using literal pathtype for '/var'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Handling file existence constraints on '/var'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Additional promise info: source path '/var/rudder/cfengine-community/inputs/filesPermissions/1.1/filesPermissio
ns.cf' at line 136 comment 'Setting the file owner'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: File permissions on '/var' as promised
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Defining promise result class 'b2117b05_0ae1_491a_b27f_96096f776785__d085c4f1_7bc8_4c6d_9fd0_1ac1a442f00f__15_v
ar_owner_ok'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Entering '/var/tmp', level 0
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Handling file existence constraints on '/var/tmp/openscap-_REDACTED_BY_FLO.x86_64.rpm'
2014-10-09T22:31:10+0200 verbose: /default/files_permissions/methods/'any'/default/check_permissions/files/'/var'[0]: Additional promise info: source path '/var/rudder/cfengine-community/inputs/filesPermissions/1.1/filesPermissio
ns.cf' at line 136 comment 'Setting the file owner'
Updated by Florian Heigl about 10 years ago
I disabled this directive (COREOS_Dirs) and the error messages are not coming anymore, so problem seems to be someone around here.
The parallel COREOS_Files is still active and working fine.
Updated by Nicolas CHARLES about 10 years ago
There is indeed something odd going on there.
Could you confirm the version of the rudder-agent you are using, both at your tiny home lab and big lab ?
Could you also try with the latest nightly of rudder-agent 2.11 ? We fixed something that may be related, in promises evaluation
Updated by Florian Heigl about 10 years ago
Versions where i have it happening:
rudder-agent-2.11.2.release-1.SLES.11 sles11sp2 sles11sp2
rudder-agent-2.12.0.alpha1.git201409220505-1.SLES.11
Versions where I don't have it happening:
rudder-agent-2.11.3.release-1.SLES.11 @ sles11sp3
Will update agent to requested version next.
Updated by Florian Heigl about 10 years ago
Tested installing the following agent:
On tiny lab sles11sp3:- zypper install rudder-agent-2.11.3.release-1.SLES.11.x86_64.rpm
Segmentation fault
- zypper install rudder-agent-2.11.3.release-1.SLES.11.x86_64.rpm
Segmentation fault (core dumped)
Updated by Florian Heigl about 10 years ago
Disabling all other directives made the problem go away. I'll re-enable them one by one.
R: result_success@inventory-all@inventory-all@6@inventory@None@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4#Next inventory scheduled between 00:00 and 06:00
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner root already matches current owner for: /
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Group root already matches current group for: /
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Mode 0755 already matches current mode for: /
R: @FilesPermissions@result_success@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner, group and permissions already correct for /
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/boot/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner root already matches current owner for: /boot/
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/boot/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Group root already matches current group for: /boot/
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/boot/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Mode 0755 already matches current mode for: /boot/
R: @FilesPermissions@result_success@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/boot/@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner, group and permissions already correct for /boot/
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner root already matches current owner for: /var
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Group root already matches current group for: /var
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Mode 0755 already matches current mode for: /var
R: @FilesPermissions@result_success@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner, group and permissions already correct for /var
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var/lib@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner root already matches current owner for: /var/lib
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var/lib@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Group root already matches current group for: /var/lib
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var/lib@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Mode 0755 already matches current mode for: /var/lib
R: @FilesPermissions@result_success@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/var/lib@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner, group and permissions already correct for /var/lib
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/boot/grub@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Owner root already matches current owner for: /boot/grub
R: @FilesPermissions@log_info@b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@22@File permissions@/boot/grub@2014-10-11 13:36:18+00:00##1b724ab4-d066-467b-8aaf-c2fe2c8ca6b4@#Group root already matches current group for: /boot/grub
@
In my understanding, in RFC speak, correct???? that:
another directive SHOULD NOT be able to overlap this one's behaviour.
Updated by Florian Heigl about 10 years ago
It is triggered as soon as i "Enable" the second instance of this technique.
A directive called T_COREOS_File_permissions.
permlist if disabled:
@- policyIsntanceId:file:user:group:mode:edituser:editgroup:editmode:suid:sgid:recursion
b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@24:/:root:root:755:true:true:true:false:false:false
b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@24:/var:root:root:755:true:true:true:false:false:false
b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@24:/var/lib:root:root:755:true:true:true:false:false:false
b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@24:/boot/:root:root:755:true:true:true:false:false:false
b2117b05-0ae1-491a-b27f-96096f776785@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@24:/boot/grub:root:root:755:true:true:true:false:false:false
@
permlist if enabled:
b2117b05-0ae1-491a-b27f-96096f77678525:/:root:root:755:true:true:true:false:false:false@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@
b2117b05-0ae1-491a-b27f-96096f77678525:/var:root:root:755:true:true:true:false:false:false@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@
b2117b05-0ae1-491a-b27f-96096f77678525:/var/lib:root:root:755:true:true:true:false:false:false@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@
b2117b05-0ae1-491a-b27f-96096f77678525:/boot/:root:root:755:true:true:true:false:false:false@d085c4f1-7bc8-4c6d-9fd0-1ac1a442f00f@
b2117b05-0ae1-491a-b27f-96096f77678525:/boot/grub:root:root:755:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/resolv.conf:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/nsswitch.conf:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/passwd:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/shadow:root:shadow:640:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/fstab:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/group:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/grub.conf:root:root:600:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/hosts:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/services:root:root:644:true:true:true:false:false:false@da15f5d5-a0d5-4a70-b67c-f4e3067fcc02@
b2117b05-0ae1-491a-b27f-96096f77678525:/etc/ssh/sshd_config:root:root:640:true:true:true:false:false:false
I don't see a missing field in there on first glance.
All edit_recurse settings continue to be "false".
Updated by François ARMAND about 10 years ago
- Category set to Techniques
- Status changed from New to 8
- Assignee set to Nicolas CHARLES
- Priority changed from N/A to 1 (highest)
- Target version set to 2.11.4
Thank you so much for minimizing that one.
Nico, could you look to that ?
Updated by Nicolas CHARLES about 10 years ago
Thank you for the detailed bug report, i'm digging into it.
Updated by Nicolas CHARLES about 10 years ago
Ok, I managed to reproduce it
The suid and recursion is not correctly passed, only for /var entry.
I have so far no idea why
Updated by Nicolas CHARLES about 10 years ago
I've opened a bug on CFengine bugtracker
https://dev.cfengine.com/issues/6674
Updated by Nicolas CHARLES about 10 years ago
- Status changed from 8 to Pending technical review
- Assignee changed from Nicolas CHARLES to Benoît PECCATTE
- Pull Request set to https://github.com/Normation/rudder-techniques/pull/537
PR is available there
https://github.com/Normation/rudder-techniques/pull/537
Benoit, could you have a look at it ?
thanks
Updated by Nicolas CHARLES about 10 years ago
This bug is quite important, could you review it ?
Updated by Benoît PECCATTE about 10 years ago
- Status changed from Pending technical review to Discussion
- Assignee changed from Benoît PECCATTE to Nicolas CHARLES
Updated by Nicolas CHARLES about 10 years ago
- Status changed from Discussion to Pending technical review
- Assignee changed from Nicolas CHARLES to Benoît PECCATTE
- Pull Request changed from https://github.com/Normation/rudder-techniques/pull/537 to https://github.com/Normation/rudder-techniques/pull/553
Updated by Nicolas CHARLES about 10 years ago
- Status changed from Pending technical review to Pending release
- % Done changed from 0 to 100
Applied in changeset policy-templates:commit:8cec663a04bc21eb626d17dad83e27ddec5b0433.
Updated by Benoît PECCATTE about 10 years ago
Applied in changeset policy-templates:commit:8a8b758fc280b57a55d05abe5f5fc944fded27d4.
Updated by Vincent MEMBRÉ about 10 years ago
- Subject changed from filesPermissions recursion applied although not configured to permissions may be applied recursively even if not asked to by "filesPermissions" Technique
Updated by Vincent MEMBRÉ about 10 years ago
- Subject changed from permissions may be applied recursively even if not asked to by "filesPermissions" Technique to Permissions may be applied recursively even if not asked to by "filesPermissions" Technique
- Target version changed from 2.11.4 to 2.6.19
Updated by Vincent MEMBRÉ about 10 years ago
- Status changed from Pending release to Released