Re: Re: cf-agent floods logs with execv errors

"'Nick Anderson' via help-cfengine" <[email protected]> Thu, 25 Apr 2024 10:24:15 -0500
Newsgroups gmane.comp.sysutils.cfengine.general
Message-ID <CAE46pPtXT8Vy1DWbRu-KnqvU5AgL7bc_vfJ4EbADzX8fhH+Tiw@mail.gmail.com>
Hey it finally landed.

On Thu, Apr 25, 2024 at 9:11 AM Xander Cage <[email protected]>
wrote:

> knock, knock...
>
> On Monday, April 22, 2024 at 4:31:16 PM UTC+2 [email protected]
> wrote:
>
>>
>> Xander,
>>
>> I don't know why your messages are constantly held for moderation. I
>> permanently approved them, but for whatever reason they show up as
>> "deleted". Can you try to respond again?
>> On Friday, April 19, 2024 at 9:25:56 AM UTC-5 Nick Anderson wrote:
>>
>>> I think this will do it:
>>>
>>> ```
>>> modified   lib/vcs.cf
>>> @@ -290,14 +290,10 @@ bundle agent git(repo_path, subcmd, args)
>>>        comment => "So that we don't mess up permissions, we will just
>>> execute
>>>                      all commands as the current group of .git";
>>>
>>> -      # We get the passwd entry from the user that owns the repo so
>>> -      # that we can extract the home directory for later use.
>>> -      "repo_uid_passwd_ent"
>>> -        string => execresult("$(paths.getent) passwd $(repo_uid)",
>>> noshell),
>>> -        comment => "We need to extract the home directory of the repo
>>> -                    owner so that it can be used to avoid errors from
>>> -                    unprivledged execution trying to access the root
>>> -                    users git config.";
>>> +      # Data container with user info
>>> +      # {"description":"Luke
>>> Skywalker","gid":1000,"home_dir":"/home/luke","shell":"/bin/bash","uid":1000,"username":"luke"}
>>> +      "repo_userinfo"
>>> +        data => getuserinfo( "$(repo_uid)" );
>>>
>>>    classes:
>>>        "am_root" expression => strcmp($(this.promiser_uid), "0");
>>> @@ -311,24 +307,14 @@ bundle agent git(repo_path, subcmd, args)
>>>          not => strcmp($(this.promiser_uid), $(repo_uid)),
>>>          if => isvariable( repo_uid );
>>>
>>> -    am_root.need_to_drop::
>>> -      # This regular expression could be tightened up
>>> -      # Extract the home directory from the owner of the repository
>>> -      # into $(repo_uid_passwd[1])
>>> -      "extracted_repo_uid_home"
>>> -        expression => regextract( ".*:.*:\d+:\d+:.*:(.*):.*",
>>> -                                  $(repo_uid_passwd_ent),
>>> -                                  "repo_uid_passwd" ),
>>> -        if => isvariable("repo_uid_passwd_ent");
>>> -
>>> -  commands:
>>> + commands:
>>>      am_root.need_to_drop::
>>>        # Because cfengine does not inherit the shell environment when
>>>        # executing commands, git will look for the root users git
>>>        # config and error when the executing user does not have
>>>        # access. So we need to set the home directory of the executing
>>>        # user.
>>> -      "$(paths.env) HOME=$(repo_uid_passwd[1]) $(oneliner)"
>>> +      "$(paths.env) HOME=$(repo_userinfo[home_dir]) $(oneliner)"
>>>          args => "$(subcmd) $(args)",
>>>          classes => kept_successful_command,
>>>          contain => setuidgid_dir( $(repo_uid), $(repo_gid),
>>> $(repo_path) );
>>> @@ -341,8 +327,8 @@ bundle agent git(repo_path, subcmd, args)
>>>
>>>    reports:
>>>      "DEBUG|DEBUG_$(this.bundle).am_root.need_to_drop"::
>>> -      "DEBUG $(this.bundle): with dropped privileges to uid
>>> '$(repo_uid)' and gid '$(repo_gid)', in directory '$(repo_path)', running
>>> Git command '$(paths.env) HOME=\"$(repo_uid_passwd[1])\" $(oneliner)
>>> $(subcmd) $(args)'"
>>> -        if => isvariable("repo_uid_passwd[1]");
>>> +      "DEBUG $(this.bundle): with dropped privileges to uid
>>> '$(repo_uid)' and gid '$(repo_gid)', in directory '$(repo_path)', running
>>> Git command '$(paths.env) HOME=\"$(repo_userinfo[home_dir])\" $(oneliner)
>>> $(subcmd) $(args)'"
>>> +        if => isvariable("repo_userinfo[home_dir]");
>>> ```
>>>
>>> Care to test that out and open a pull request?
>>>
>>> On Fri, Apr 19, 2024 at 9:03 AM Nick Anderson <[email protected]>
>>> wrote:
>>>
>>>> Do you plan to open a pull request to refactor it to use getuserinfo()?
>>>>
>>>> On Fri, Apr 19, 2024 at 8:48 AM Xander Cage <[email protected]>
>>>> wrote:
>>>>
>>>>> getuserinfo function works in aix...
>>>>>
>>>>> root@aixtest01: /root/cfe_testbed # /var/cfengine/bin/cf-agent -KI -f
>>>>> ./getuserinfo.cf
>>>>> R: I am '', root shell is '/usr/bin/ksh', and the agent was started by
>>>>> {"description":"","gid":0,"home_dir":"/root","shell":"/usr/bin/ksh","uid":0,"username":"root"}
>>>>>
>>>>> On Tuesday, April 16, 2024 at 7:06:17 PM UTC+2 [email protected]
>>>>> wrote:
>>>>>
>>>>>> Thanks for the report Xander.
>>>>>>
>>>>>> It does look like that bit of policy could use some refactoring to
>>>>>> work on systems without getent.
>>>>>>
>>>>>> Probably we could use the `getuserinfo()` policy function instead
>>>>>> which includes the home_dir entry.
>>>>>>
>>>>>> https://docs.cfengine.com/docs/3.21/reference-functions-getuserinfo.html
>>>>>>
>>>>>> Let us know if you want to work on the fix.
>>>>>>
>>>>>> I created a ticket:
>>>>>> https://northerntech.atlassian.net/browse/CFE-4375
>>>>>>
>>>>>> -Craig
>>>>>>
>>>>>> On Tue, Apr 16, 2024 at 6:31 AM Xander Cage <[email protected]>
>>>>>> wrote:
>>>>>>
>>>>>>> a quick grep in the masterfiles showed two instances of a getent
>>>>>>> call...
>>>>>>>
>>>>>>> root@nimvie: /var/cfengine/masterfiles # grep -r getent *
>>>>>>> lib/paths.cf:      "path[getent]"        string =>
>>>>>>> "/usr/bin/getent";
>>>>>>> lib/vcs.cf:        string => execresult("$(paths.getent) passwd
>>>>>>> $(repo_uid)", noshell),
>>>>>>>
>>>>>>> vcs.cf seemst to be the culprit...
>>>>>>>
>>>>>>> On Tuesday, April 16, 2024 at 12:12:48 PM UTC+2 Xander Cage wrote:
>>>>>>>
>>>>>>>> i was just informed the getent is not a linux specific thing but is
>>>>>>>> part of posix . anyway, its not in aix so still a fix is necessary.
>>>>>>>>
>>>>>>>> On Tuesday, April 16, 2024 at 11:26:08 AM UTC+2 Xander Cage wrote:
>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> cf-agent complains about /usr/bin/getent not found. as this is an
>>>>>>>>> aix environment this
>>>>>>>>> makes no sense. getent is a linux thing.
>>>>>>>>>
>>>>>>>>> Apr 16 09:36:35 kug01132 user:err|error cf-agent[10617102]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 09:41:25 kug01132 user:err|error cf-agent[2556430]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 09:46:15 kug01132 user:err|error cf-agent[36569520]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 09:51:06 kug01132 user:err|error cf-agent[18416128]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 09:55:56 kug01132 user:err|error cf-agent[54067624]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:01:47 kug01132 user:err|error cf-agent[459462]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:06:37 kug01132 user:err|error cf-agent[20120026]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:11:27 kug01132 user:err|error cf-agent[58458376]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:16:17 kug01132 user:err|error cf-agent[58458558]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:21:07 kug01132 user:err|error cf-agent[17564104]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:25:57 kug01132 user:err|error cf-agent[43057456]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:31:48 kug01132 user:err|error cf-agent[23462412]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:36:37 kug01132 user:err|error cf-agent[4325842]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:41:28 kug01132 user:err|error cf-agent[52036014]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:46:18 kug01132 user:err|error cf-agent[18875116]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:51:09 kug01132 user:err|error cf-agent[43057622]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>> Apr 16 10:55:58 kug01132 user:err|error cf-agent[46203222]:
>>>>>>>>> CFEngine(agent)  Couldn't run '/usr/bin/getent'. (execv: No such file or
>>>>>>>>> directory)
>>>>>>>>>
>>>>>>>>> needs to be fixed...
>>>>>>>>>
>>>>>>>>> wbr
>>>>>>>>>
>>>>>>>>> chris
>>>>>>>>>
>>>>>>>> --
>>>>>>> You received this message because you are subscribed to the Google
>>>>>>> Groups "help-cfengine" group.
>>>>>>> To unsubscribe from this group and stop receiving emails from it,
>>>>>>> send an email to [email protected].
>>>>>>> To view this discussion on the web visit
>>>>>>> https://groups.google.com/d/msgid/help-cfengine/ca18dddf-38ea-4027-9aec-9840369106dbn%40googlegroups.com
>>>>>>> <https://groups.google.com/d/msgid/help-cfengine/ca18dddf-38ea-4027-9aec-9840369106dbn%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>>> .
>>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>>> *Craig Comstock* (he/him)
>>>>>> CFEngineer/Digger | CFEngine <https://cfengine.com/>
>>>>>> Kansas, USA
>>>>>>  <https://www.linkedin.com/company/northern.tech> <https://twitter.com/northerntechhq> <https://northern.tech> Northern.tech <https://northern.tech> | Securing the world's connected devices
>>>>>>
>>>>>> --
>>>>> You received this message because you are subscribed to the Google
>>>>> Groups "help-cfengine" group.
>>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>>> an email to [email protected].
>>>>> To view this discussion on the web visit
>>>>> https://groups.google.com/d/msgid/help-cfengine/55df1c75-5450-4723-b6b4-998dd55828afn%40googlegroups.com
>>>>> <https://groups.google.com/d/msgid/help-cfengine/55df1c75-5450-4723-b6b4-998dd55828afn%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>> .
>>>>>
>>>> --
> You received this message because you are subscribed to a topic in the
> Google Groups "help-cfengine" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/help-cfengine/tkSCOPYIxBk/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> [email protected].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/help-cfengine/d966f88a-6b85-4bf3-a188-fe82392cfb8dn%40googlegroups.com
> <https://groups.google.com/d/msgid/help-cfengine/d966f88a-6b85-4bf3-a188-fe82392cfb8dn%40googlegroups.com?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/CAE46pPtXT8Vy1DWbRu-KnqvU5AgL7bc_vfJ4EbADzX8fhH%2BTiw%40mail.gmail.com.