Re: Re: cf-agent floods logs with execv errors
"'Nick Anderson' via help-cfengine" <[email protected]> Thu, 25 Apr 2024 10:24:15 -0500
| Newsgroups | gmane.comp.sysutils.cfengine.general |
|---|---|
| Message-ID | <CAE46pPtXT8Vy1DWbRu-KnqvU5AgL7bc_vfJ4EbADzX8fhH+Tiw@mail.gmail.com> |
Hey it finally landed. On Thu, Apr 25, 2024 at 9:11 AM Xander Cage <[email protected]> wrote: > knock, knock... > > On Monday, April 22, 2024 at 4:31:16 PM UTC+2 [email protected] > wrote: > >> >> Xander, >> >> I don't know why your messages are constantly held for moderation. I >> permanently approved them, but for whatever reason they show up as >> "deleted". Can you try to respond again? >> On Friday, April 19, 2024 at 9:25:56 AM UTC-5 Nick Anderson wrote: >> >>> I think this will do it: >>> >>> ``` >>> modified lib/vcs.cf >>> @@ -290,14 +290,10 @@ bundle agent git(repo_path, subcmd, args) >>> comment => "So that we don't mess up permissions, we will just >>> execute >>> all commands as the current group of .git"; >>> >>> - # We get the passwd entry from the user that owns the repo so >>> - # that we can extract the home directory for later use. >>> - "repo_uid_passwd_ent" >>> - string => execresult("$(paths.getent) passwd $(repo_uid)", >>> noshell), >>> - comment => "We need to extract the home directory of the repo >>> - owner so that it can be used to avoid errors from >>> - unprivledged execution trying to access the root >>> - users git config."; >>> + # Data container with user info >>> + # {"description":"Luke >>> Skywalker","gid":1000,"home_dir":"/home/luke","shell":"/bin/bash","uid":1000,"username":"luke"} >>> + "repo_userinfo" >>> + data => getuserinfo( "$(repo_uid)" ); >>> >>> classes: >>> "am_root" expression => strcmp($(this.promiser_uid), "0"); >>> @@ -311,24 +307,14 @@ bundle agent git(repo_path, subcmd, args) >>> not => strcmp($(this.promiser_uid), $(repo_uid)), >>> if => isvariable( repo_uid ); >>> >>> - am_root.need_to_drop:: >>> - # This regular expression could be tightened up >>> - # Extract the home directory from the owner of the repository >>> - # into $(repo_uid_passwd[1]) >>> - "extracted_repo_uid_home" >>> - expression => regextract( ".*:.*:\d+:\d+:.*:(.*):.*", >>> - $(repo_uid_passwd_ent), >>> - "repo_uid_passwd" ), >>> - if => isvariable("repo_uid_passwd_ent"); >>> - >>> - commands: >>> + commands: >>> am_root.need_to_drop:: >>> # Because cfengine does not inherit the shell environment when >>> # executing commands, git will look for the root users git >>> # config and error when the executing user does not have >>> # access. So we need to set the home directory of the executing >>> # user. >>> - "$(paths.env) HOME=$(repo_uid_passwd[1]) $(oneliner)" >>> + "$(paths.env) HOME=$(repo_userinfo[home_dir]) $(oneliner)" >>> args => "$(subcmd) $(args)", >>> classes => kept_successful_command, >>> contain => setuidgid_dir( $(repo_uid), $(repo_gid), >>> $(repo_path) ); >>> @@ -341,8 +327,8 @@ bundle agent git(repo_path, subcmd, args) >>> >>> reports: >>> "DEBUG|DEBUG_$(this.bundle).am_root.need_to_drop":: >>> - "DEBUG $(this.bundle): with dropped privileges to uid >>> '$(repo_uid)' and gid '$(repo_gid)', in directory '$(repo_path)', running >>> Git command '$(paths.env) HOME=\"$(repo_uid_passwd[1])\" $(oneliner) >>> $(subcmd) $(args)'" >>> - if => isvariable("repo_uid_passwd[1]"); >>> + "DEBUG $(this.bundle): with dropped privileges to uid >>> '$(repo_uid)' and gid '$(repo_gid)', in directory '$(repo_path)', running >>> Git command '$(paths.env) HOME=\"$(repo_userinfo[home_dir])\" $(oneliner) >>> $(subcmd) $(args)'" >>> + if => isvariable("repo_userinfo[home_dir]"); >>> ``` >>> >>> Care to test that out and open a pull request? >>> >>> On Fri, Apr 19, 2024 at 9:03 AM Nick Anderson <[email protected]> >>> wrote: >>> >>>> Do you plan to open a pull request to refactor it to use getuserinfo()? >>>> >>>> On Fri, Apr 19, 2024 at 8:48 AM Xander Cage <[email protected]> >>>> wrote: >>>> >>>>> getuserinfo function works in aix... >>>>> >>>>> root@aixtest01: /root/cfe_testbed # /var/cfengine/bin/cf-agent -KI -f >>>>> ./getuserinfo.cf >>>>> R: I am '', root shell is '/usr/bin/ksh', and the agent was started by >>>>> {"description":"","gid":0,"home_dir":"/root","shell":"/usr/bin/ksh","uid":0,"username":"root"} >>>>> >>>>> On Tuesday, April 16, 2024 at 7:06:17 PM UTC+2 [email protected] >>>>> wrote: >>>>> >>>>>> Thanks for the report Xander. >>>>>> >>>>>> It does look like that bit of policy could use some refactoring to >>>>>> work on systems without getent. >>>>>> >>>>>> Probably we could use the `getuserinfo()` policy function instead >>>>>> which includes the home_dir entry. >>>>>> >>>>>> https://docs.cfengine.com/docs/3.21/reference-functions-getuserinfo.html >>>>>> >>>>>> Let us know if you want to work on the fix. >>>>>> >>>>>> I created a ticket: >>>>>> https://northerntech.atlassian.net/browse/CFE-4375 >>>>>> >>>>>> -Craig >>>>>> >>>>>> On Tue, Apr 16, 2024 at 6:31 AM Xander Cage <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> a quick grep in the masterfiles showed two instances of a getent >>>>>>> call... >>>>>>> >>>>>>> root@nimvie: /var/cfengine/masterfiles # grep -r getent * >>>>>>> lib/paths.cf: "path[getent]" string => >>>>>>> "/usr/bin/getent"; >>>>>>> lib/vcs.cf: string => execresult("$(paths.getent) passwd >>>>>>> $(repo_uid)", noshell), >>>>>>> >>>>>>> vcs.cf seemst to be the culprit... >>>>>>> >>>>>>> On Tuesday, April 16, 2024 at 12:12:48 PM UTC+2 Xander Cage wrote: >>>>>>> >>>>>>>> i was just informed the getent is not a linux specific thing but is >>>>>>>> part of posix . anyway, its not in aix so still a fix is necessary. >>>>>>>> >>>>>>>> On Tuesday, April 16, 2024 at 11:26:08 AM UTC+2 Xander Cage wrote: >>>>>>>> >>>>>>>>> Hi, >>>>>>>>> >>>>>>>>> cf-agent complains about /usr/bin/getent not found. as this is an >>>>>>>>> aix environment this >>>>>>>>> makes no sense. getent is a linux thing. >>>>>>>>> >>>>>>>>> Apr 16 09:36:35 kug01132 user:err|error cf-agent[10617102]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 09:41:25 kug01132 user:err|error cf-agent[2556430]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 09:46:15 kug01132 user:err|error cf-agent[36569520]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 09:51:06 kug01132 user:err|error cf-agent[18416128]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 09:55:56 kug01132 user:err|error cf-agent[54067624]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:01:47 kug01132 user:err|error cf-agent[459462]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:06:37 kug01132 user:err|error cf-agent[20120026]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:11:27 kug01132 user:err|error cf-agent[58458376]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:16:17 kug01132 user:err|error cf-agent[58458558]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:21:07 kug01132 user:err|error cf-agent[17564104]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:25:57 kug01132 user:err|error cf-agent[43057456]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:31:48 kug01132 user:err|error cf-agent[23462412]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:36:37 kug01132 user:err|error cf-agent[4325842]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:41:28 kug01132 user:err|error cf-agent[52036014]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:46:18 kug01132 user:err|error cf-agent[18875116]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:51:09 kug01132 user:err|error cf-agent[43057622]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> Apr 16 10:55:58 kug01132 user:err|error cf-agent[46203222]: >>>>>>>>> CFEngine(agent) Couldn't run '/usr/bin/getent'. (execv: No such file or >>>>>>>>> directory) >>>>>>>>> >>>>>>>>> needs to be fixed... >>>>>>>>> >>>>>>>>> wbr >>>>>>>>> >>>>>>>>> chris >>>>>>>>> >>>>>>>> -- >>>>>>> You received this message because you are subscribed to the Google >>>>>>> Groups "help-cfengine" group. >>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>> send an email to [email protected]. >>>>>>> To view this discussion on the web visit >>>>>>> https://groups.google.com/d/msgid/help-cfengine/ca18dddf-38ea-4027-9aec-9840369106dbn%40googlegroups.com >>>>>>> <https://groups.google.com/d/msgid/help-cfengine/ca18dddf-38ea-4027-9aec-9840369106dbn%40googlegroups.com?utm_medium=email&utm_source=footer> >>>>>>> . >>>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> >>>>>> *Craig Comstock* (he/him) >>>>>> CFEngineer/Digger | CFEngine <https://cfengine.com/> >>>>>> Kansas, USA >>>>>> <https://www.linkedin.com/company/northern.tech> <https://twitter.com/northerntechhq> <https://northern.tech> Northern.tech <https://northern.tech> | Securing the world's connected devices >>>>>> >>>>>> -- >>>>> You received this message because you are subscribed to the Google >>>>> Groups "help-cfengine" group. >>>>> To unsubscribe from this group and stop receiving emails from it, send >>>>> an email to [email protected]. >>>>> To view this discussion on the web visit >>>>> https://groups.google.com/d/msgid/help-cfengine/55df1c75-5450-4723-b6b4-998dd55828afn%40googlegroups.com >>>>> <https://groups.google.com/d/msgid/help-cfengine/55df1c75-5450-4723-b6b4-998dd55828afn%40googlegroups.com?utm_medium=email&utm_source=footer> >>>>> . >>>>> >>>> -- > You received this message because you are subscribed to a topic in the > Google Groups "help-cfengine" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/help-cfengine/tkSCOPYIxBk/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/help-cfengine/d966f88a-6b85-4bf3-a188-fe82392cfb8dn%40googlegroups.com > <https://groups.google.com/d/msgid/help-cfengine/d966f88a-6b85-4bf3-a188-fe82392cfb8dn%40googlegroups.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "help-cfengine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/CAE46pPtXT8Vy1DWbRu-KnqvU5AgL7bc_vfJ4EbADzX8fhH%2BTiw%40mail.gmail.com.