Re: Re: cf-agent floods logs with execv errors
Xander Cage <[email protected]> Thu, 25 Apr 2024 07:11:33 -0700 (PDT)
| Newsgroups | gmane.comp.sysutils.cfengine.general |
|---|---|
| Message-ID | <[email protected]> |
knock, knock... On Monday, April 22, 2024 at 4:31:16 PM UTC+2 [email protected] wrote: > > Xander, > > I don't know why your messages are constantly held for moderation. I > permanently approved them, but for whatever reason they show up as > "deleted". Can you try to respond again? > On Friday, April 19, 2024 at 9:25:56 AM UTC-5 Nick Anderson wrote: > >> I think this will do it: >> >> ``` >> modified lib/vcs.cf >> @@ -290,14 +290,10 @@ bundle agent git(repo_path, subcmd, args) >> comment => "So that we don't mess up permissions, we will just >> execute >> all commands as the current group of .git"; >> >> - # We get the passwd entry from the user that owns the repo so >> - # that we can extract the home directory for later use. >> - "repo_uid_passwd_ent" >> - string => execresult("$(paths.getent) passwd $(repo_uid)", >> noshell), >> - comment => "We need to extract the home directory of the repo >> - owner so that it can be used to avoid errors from >> - unprivledged execution trying to access the root >> - users git config."; >> + # Data container with user info >> + # {"description":"Luke >> Skywalker","gid":1000,"home_dir":"/home/luke","shell":"/bin/bash","uid":1000,"username":"luke"} >> + "repo_userinfo" >> + data => getuserinfo( "$(repo_uid)" ); >> >> classes: >> "am_root" expression => strcmp($(this.promiser_uid), "0"); >> @@ -311,24 +307,14 @@ bundle agent git(repo_path, subcmd, args) >> not => strcmp($(this.promiser_uid), $(repo_uid)), >> if => isvariable( repo_uid ); >> >> - am_root.need_to_drop:: >> - # This regular expression could be tightened up >> - # Extract the home directory from the owner of the repository >> - # into $(repo_uid_passwd[1]) >> - "extracted_repo_uid_home" >> - expression => regextract( ".*:.*:\d+:\d+:.*:(.*):.*", >> - $(repo_uid_passwd_ent), >> - "repo_uid_passwd" ), >> - if => isvariable("repo_uid_passwd_ent"); >> - >> - commands: >> + commands: >> am_root.need_to_drop:: >> # Because cfengine does not inherit the shell environment when >> # executing commands, git will look for the root users git >> # config and error when the executing user does not have >> # access. So we need to set the home directory of the executing >> # user. >> - "$(paths.env) HOME=$(repo_uid_passwd[1]) $(oneliner)" >> + "$(paths.env) HOME=$(repo_userinfo[home_dir]) $(oneliner)" >> args => "$(subcmd) $(args)", >> classes => kept_successful_command, >> contain => setuidgid_dir( $(repo_uid), $(repo_gid), $(repo_path) >> ); >> @@ -341,8 +327,8 @@ bundle agent git(repo_path, subcmd, args) >> >> reports: >> "DEBUG|DEBUG_$(this.bundle).am_root.need_to_drop":: >> - "DEBUG $(this.bundle): with dropped privileges to uid >> '$(repo_uid)' and gid '$(repo_gid)', in directory '$(repo_path)', running >> Git command '$(paths.env) HOME=\"$(repo_uid_passwd[1])\" $(oneliner) >> $(subcmd) $(args)'" >> - if => isvariable("repo_uid_passwd[1]"); >> + "DEBUG $(this.bundle): with dropped privileges to uid >> '$(repo_uid)' and gid '$(repo_gid)', in directory '$(repo_path)', running >> Git command '$(paths.env) HOME=\"$(repo_userinfo[home_dir])\" $(oneliner) >> $(subcmd) $(args)'" >> + if => isvariable("repo_userinfo[home_dir]"); >> ``` >> >> Care to test that out and open a pull request? >> >> On Fri, Apr 19, 2024 at 9:03 AM Nick Anderson <[email protected]> >> wrote: >> >>> Do you plan to open a pull request to refactor it to use getuserinfo()? >>> >>> On Fri, Apr 19, 2024 at 8:48 AM Xander Cage <[email protected]> wrote: >>> >>>> getuserinfo function works in aix... >>>> >>>> root@aixtest01: /root/cfe_testbed # /var/cfengine/bin/cf-agent -KI -f ./ >>>> getuserinfo.cf >>>> R: I am '', root shell is '/usr/bin/ksh', and the agent was started by >>>> {"description":"","gid":0,"home_dir":"/root","shell":"/usr/bin/ksh","uid":0,"username":"root"} >>>> >>>> On Tuesday, April 16, 2024 at 7:06:17 PM UTC+2 [email protected] >>>> wrote: >>>> >>>>> Thanks for the report Xander. >>>>> >>>>> It does look like that bit of policy could use some refactoring to >>>>> work on systems without getent. >>>>> >>>>> Probably we could use the `getuserinfo()` policy function instead >>>>> which includes the home_dir entry. >>>>> >>>>> https://docs.cfengine.com/docs/3.21/reference-functions-getuserinfo.html >>>>> >>>>> Let us know if you want to work on the fix. >>>>> >>>>> I created a ticket: >>>>> https://northerntech.atlassian.net/browse/CFE-4375 >>>>> >>>>> -Craig >>>>> >>>>> On Tue, Apr 16, 2024 at 6:31 AM Xander Cage <[email protected]> >>>>> wrote: >>>>> >>>>>> a quick grep in the masterfiles showed two instances of a getent >>>>>> call... >>>>>> >>>>>> root@nimvie: /var/cfengine/masterfiles # grep -r getent * >>>>>> lib/paths.cf: "path[getent]" string => "/usr/bin/getent"; >>>>>> lib/vcs.cf: string => execresult("$(paths.getent) passwd >>>>>> $(repo_uid)", noshell), >>>>>> >>>>>> vcs.cf seemst to be the culprit... >>>>>> >>>>>> On Tuesday, April 16, 2024 at 12:12:48 PM UTC+2 Xander Cage wrote: >>>>>> >>>>>>> i was just informed the getent is not a linux specific thing but is >>>>>>> part of posix . anyway, its not in aix so still a fix is necessary. >>>>>>> >>>>>>> On Tuesday, April 16, 2024 at 11:26:08 AM UTC+2 Xander Cage wrote: >>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> cf-agent complains about /usr/bin/getent not found. as this is an >>>>>>>> aix environment this >>>>>>>> makes no sense. getent is a linux thing. >>>>>>>> >>>>>>>> Apr 16 09:36:35 kug01132 user:err|error cf-agent[10617102]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 09:41:25 kug01132 user:err|error cf-agent[2556430]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 09:46:15 kug01132 user:err|error cf-agent[36569520]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 09:51:06 kug01132 user:err|error cf-agent[18416128]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 09:55:56 kug01132 user:err|error cf-agent[54067624]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:01:47 kug01132 user:err|error cf-agent[459462]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:06:37 kug01132 user:err|error cf-agent[20120026]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:11:27 kug01132 user:err|error cf-agent[58458376]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:16:17 kug01132 user:err|error cf-agent[58458558]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:21:07 kug01132 user:err|error cf-agent[17564104]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:25:57 kug01132 user:err|error cf-agent[43057456]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:31:48 kug01132 user:err|error cf-agent[23462412]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:36:37 kug01132 user:err|error cf-agent[4325842]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:41:28 kug01132 user:err|error cf-agent[52036014]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:46:18 kug01132 user:err|error cf-agent[18875116]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:51:09 kug01132 user:err|error cf-agent[43057622]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> Apr 16 10:55:58 kug01132 user:err|error cf-agent[46203222]: >>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>> directory) >>>>>>>> >>>>>>>> needs to be fixed... >>>>>>>> >>>>>>>> wbr >>>>>>>> >>>>>>>> chris >>>>>>>> >>>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "help-cfengine" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to [email protected]. >>>>>> To view this discussion on the web visit >>>>>> https://groups.google.com/d/msgid/help-cfengine/ca18dddf-38ea-4027-9aec-9840369106dbn%40googlegroups.com >>>>>> <https://groups.google.com/d/msgid/help-cfengine/ca18dddf-38ea-4027-9aec-9840369106dbn%40googlegroups.com?utm_medium=email&utm_source=footer> >>>>>> . >>>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> *Craig Comstock* (he/him) >>>>> CFEngineer/Digger | CFEngine <https://cfengine.com/> >>>>> Kansas, USA >>>>> <https://www.linkedin.com/company/northern.tech> <https://twitter.com/northerntechhq> <https://northern.tech> Northern.tech <https://northern.tech> | Securing the world's connected devices >>>>> >>>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "help-cfengine" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected]. >>>> To view this discussion on the web visit >>>> https://groups.google.com/d/msgid/help-cfengine/55df1c75-5450-4723-b6b4-998dd55828afn%40googlegroups.com >>>> <https://groups.google.com/d/msgid/help-cfengine/55df1c75-5450-4723-b6b4-998dd55828afn%40googlegroups.com?utm_medium=email&utm_source=footer> >>>> . >>>> >>> -- You received this message because you are subscribed to the Google Groups "help-cfengine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/d966f88a-6b85-4bf3-a188-fe82392cfb8dn%40googlegroups.com.