Re: Could not load requested further augments from file

"'Vratislav Podzimek' via help-cfengine" <[email protected]> Tue, 20 Aug 2024 08:21:56 +0200
Newsgroups	gmane.comp.sysutils.cfengine.general
Message-ID	<[email protected]>
On Mon, 2024-08-19 at 13:46 -0700, Beto wrote:
> So, there were two issues:
> 
>    1. AVCs on an augments file in /srv that selinux was blocking access to.
>    2. Typo in host_specific.json.  Turns out cfe doesn't recognize host_specfic.json.
> 
> Rather than fiddling with selinux contexts  I moved the augments file in /srv to host_specific.json and updated def.json to use the variables from host_specific.json.
Glad you found a solution. In case you wanted to use /srv for CFEngine
policy/JSON files anyway, it should be easy to add and apply a new SELinux file
context rule with something like this:

  semanage fcontext -a -t cfengine_var_lib_t '/srv/whatever/specific/dir(/.*)?'
  restorecon -Rv /srv/whatever/specific/dir

Of course, it would be better to do this from policy, but that would have to
check if the rule is already present first. Too bad that
https://build.cfengine.com/modules/?query=selinux gives 0 results, maybe someone
could add a small CFEngine module, perhaps with a new custom promise type, for
at least the fcontext rules...? 😉️ Modules welcome!

--
Vratislav

> 
> Thank you all for your help.
> On Monday, August 19, 2024 at 8:15:52 AM UTC-5 [email protected] wrote:
> > Yes, I introduced the idea that the docs are "imprecise" because I got lucky enough to choose the ONE non-sys variable which is available in augments for expansion: def.jq which is the only non-sys non-const variable which is defined in the agent aka C-code as can be seen with this command to show all variables and filter out sys and const variables:
> > 
> > $ cf-promises --show-vars | grep "source=agent" | grep -v sys | grep -v const default:def.jq jq --compact-output --monochrome-output --ascii-output --unbuffered --sort-keys invocation,source=agent,command_name=jq 
> > 
> > So as Vrata mentioned, you are likely running into an SELinux issue.
> > 
> > -Craig
> > 
> > On Monday, August 19, 2024 at 1:12:25 AM UTC-5 [email protected] wrote:
> > > Hello,
> > > 
> > > On Fri, 2024-08-16 at 14:06 -0700, Beto wrote:
> > > > Weird thing is this occurs ONLY on RHEL8, not on RHEL7 and  this same augments configuration has been in use for years.
> > > That suggests the difference is most likely SELinux. Does it happen even if you
> > > do a manual agent run from an interactive shell with `cf-agent -KI`? If not,
> > > please double-check `ausearch -m AVC` on an affected system.
> > > 
> > > Another alternative is to run `strace -ff -- cf-agent -KI 2> cf-agent.strace`,
> > > look for the particular file name in the trace and see what happens when the
> > > file is attempted to be opened and read.
> > > 
> > > > 
> > > > I thought maybe I could use host_specific.json to get around this issue but I can't tell that host_specific.json is being seen at all (as you say the doc is "imprecise").
> > > What do you think is imprecise in the docs? I think it's quite clear:
> > > 
> > >  There are two canonical augments files, host_specific.json, and def.json
> > >  which may load additional Augments as specified by the augments key.
> > >  
> > > 
> > >  Notes:
> > >  CFEngine variables are not expanded unless otherwise noted.
> > >  
> > > 
> > > and then there is a note for the def.json file:
> > > 
> > >  sys variables are expanded in def.json and all subsequently loaded augments
> > >  as specified by the augments key.
> > >  
> > > 
> > > You can do a verbose agent run using `--verbose` to see details of what it is doing
> > > and which files it is loading.
> > > 
> > > One thing is quite clear -- the error message that further augments could not be
> > > loaded should be enhanced to explain why.
> > > 
> > > --
> > > Vratislav
> > > 
> > > > 
> > > > On Friday, August 16, 2024 at 4:00:51 PM UTC-5 Beto wrote:
> > > > > There are no selinux AVCs logged.
> > > > > 
> > > > > On Friday, August 16, 2024 at 3:42:41 PM UTC-5 [email protected] wrote:
> > > > > > Def.jq might itself be special what about def.foo? 
> > > > > > 
> > > > > > On Fri, Aug 16, 2024, 3:10 PM '[email protected]' via help-cfengine <[email protected]> wrote:
> > > > > > > The docs might be a bit imprecise. https://docs.cfengine.com/docs/3.24/reference-language-concepts-augments.html says in two separate notes:
> > > > > > > 
> > > > > > >  * CFEngine variables are not expanded unless otherwise noted.
> > > > > > >  * sys variables are expanded in def.json and all subsequently loaded augments as specified by the augments key.
> > > > > > > ---
> > > > > > > 
> > > > > > > I did a little test and it does seem your def.network and sys variables should both be expanded so I wonder if it is an access or selinux issue?
> > > > > > > 
> > > > > > > Maybe check /var/log/audit/audit.log for cf-serverd related entries?
> > > > > > > 
> > > > > > > ---
> > > > > > > 
> > > > > > > My test:
> > > > > > > $ cat def.json 
> > > > > > > {
> > > > > > >   "vars": {
> > > > > > >     "foo": "${def.jq}",
> > > > > > >     "bar": "baz"
> > > > > > >   }
> > > > > > > }
> > > > > > > 
> > > > > > > $ cat t.cf 
> > > > > > > bundle agent main
> > > > > > > {
> > > > > > >   reports:
> > > > > > >  "foo is ${default:def.foo}";
> > > > > > >  "bar is ${default:def.bar}";
> > > > > > >  "def.jq is ${def.jq}";
> > > > > > > }
> > > > > > > 
> > > > > > > result:
> > > > > > > R: foo is jq --compact-output --monochrome-output --ascii-output --unbuffered --sort-keys
> > > > > > > R: bar is baz
> > > > > > > R: def.jq is jq --compact-output --monochrome-output --ascii-output --unbuffered --sort-keys
> > > > > > > On Friday, August 16, 2024 at 2:57:53 PM UTC-5 Nick Anderson wrote:
> > > > > > > > I dont think you can use non sys variables in augments like that becuase augmwnts is loaded before policy is read at all. Check the augments docs (i can't atm, on the move). 
> > > > > > > > 
> > > > > > > > On Fri, Aug 16, 2024, 1:43 PM Beto <[email protected]> wrote:
> > > > > > > > > As we upgrade from RHEL7 to RHEL8 I'm seeing this in /var/log/messages:
> > > > > > > > > 
> > > > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server)  Rereading policy file '/var/cfengine/inputs/promises.cf'
> > > > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]:   error: Could not load requested further augments from file '/srv/sysadmin/etc/
> > > > > > > > > cfengine/augments.json'
> > > > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]:   error: Could not load requested further augments from file '$(sys.inputdir)/au
> > > > > > > > > gments/augments_$(def.network).json'
> > > > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server)  Could not load requested further augments from file '/srv/sysa
> > > > > > > > > dmin/etc/cfengine/augments.json'
> > > > > > > > > Aug 16 12:54:06 zombie cf-serverd[1921]: CFEngine(server)  Could not load requested further augments from file '$(sys.inp
> > > > > > > > > utdir)/augments/augments_$(def.network).json'
> > > > > > > > > 
> > > > > > > > > Not seeing this on RHEL7.
> > > > > > > > > 
> > > > > > > > > CFEngine Core 3.24.0
> > > > > > > > > CFEngine Enterprise 3.24.0
> > > > > > > > > 
> > > > > > > > > Any ideas?
> > > > > > > > > -- 
> > > > > > > > > You received this message because you are subscribed to the Google Groups "help-cfengine" group.
> > > > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> > > > > > > > > To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/857f33e7-4ac3-45f1-8b90-234de4c98bc8n%40googlegroups.com.
> > > 
> -- 
> You received this message because you are subscribed to the Google Groups "help-cfengine" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/4035b131-5b0f-438b-97bb-6a01b58cf6ean%40googlegroups.com.

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/e7a9685ed5ff0a98d313c83ad1b306d18ebfb956.camel%40northern.tech.
signature.asc (application/pgp-signature, 833 B)