Re: Newbie questions
"'Nick Anderson' via help-cfengine" <[email protected]> Fri, 08 Aug 2025 20:53:28 -0500
| Newsgroups | gmane.comp.sysutils.cfengine.general |
|---|---|
| Message-ID | <[email protected]> |
--=-=-= Content-Type: multipart/alternative; boundary="==-=-=" --==-=-= Content-Type: text/plain; charset="UTF-8" IN_PROGRESS Respond to Nick Anderson <[email protected]>: Re: [help-cfengine] Newbie questions :email: ============================================================================================ Hey Jakub, I meant to ask but apparently forgot, when you say: I've seen that bundles can modify variables and define class in the parent scope, but that seems quite horrible. Can you point me to where you see this? Modules have the power to define variables in any bundle scope of any namespace and can define namespace scoped classes in any namespace. In policy there is a narrow case where you can define a variable in a remote bundle, but only if that bundle is not defined. E.g: ,---- | bundle agent __main__ | { | vars: | "remoteBundle.myvar" string => "Hello World"; | | reports: | "$(remoteBundle.myvar)"; | } `---- ,---- | R: Hello World `---- But, it's protected when there is actual policy defining the bundle: ,---- | bundle agent __main__ | { | vars: | "remoteBundle.myvar" string => "Hello World"; | | reports: | "$(remoteBundle.myvar)"; | } | bundle agent remoteBundle | { | reports: | "$(myvar)"; | } `---- ,---- | error: Ignoring remotely-injected variable 'myvar' | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Ignoring remotely-injected variable 'myvar' | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | error: Remote bundle variable injection detected! | error: Variable identifier 'remoteBundle.myvar' is not legal | error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 | R: $(remoteBundle.myvar) `---- -- You received this message because you are subscribed to the Google Groups "help-cfengine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/help-cfengine/87bjop8dkx.fsf%40northern.tech. --==-=-= Content-Type: text/html; charset="UTF-8" <p> Hey Jakub, </p> <p> I meant to ask but apparently forgot, when you say: </p> <blockquote style="border-left: 2px solid gray; padding-left: 4px;"> <p> I've seen that bundles can modify variables and define class in the parent scope, but that seems quite horrible. </p> </blockquote> <p> Can you point me to where you see this? </p> <p> Modules have the power to define variables in any bundle scope of any namespace and can define namespace scoped classes in any namespace. </p> <p> In policy there is a narrow case where you can define a variable in a remote bundle, but only if that bundle is not defined. </p> <p> E.g: </p> <div class="org-src-container"> <pre class="src src-cfengine3"><span style="color: #a89984; font-weight: bold;">bundle</span> <span style="color: #458588; font-weight: bold;">agent</span> <span style="color: #458588;">__main__</span> <span style="color: #689d6a;">{</span> <span style="color: #a89984; font-weight: bold;">vars</span>: <span style="color: #689d6a;">"remoteBundle.myvar"</span> <span style="color: #d79921;">string</span> => <span style="color: #689d6a;">"Hello World"</span>; <span style="color: #a89984; font-weight: bold;">reports</span>: <span style="color: #689d6a;">"$(remoteBundle.myvar)"</span>; <span style="color: #689d6a;">}</span> </pre> </div> <pre class="example"> R: Hello World </pre> <p> But, it's protected when there is actual policy defining the bundle: </p> <div class="org-src-container"> <pre class="src src-cfengine3"><span style="color: #a89984; font-weight: bold;">bundle</span> <span style="color: #458588; font-weight: bold;">agent</span> <span style="color: #458588;">__main__</span> <span style="color: #689d6a;">{</span> <span style="color: #a89984; font-weight: bold;">vars</span>: <span style="color: #689d6a;">"remoteBundle.myvar"</span> <span style="color: #d79921;">string</span> => <span style="color: #689d6a;">"Hello World"</span>; <span style="color: #a89984; font-weight: bold;">reports</span>: <span style="color: #689d6a;">"$(remoteBundle.myvar)"</span>; <span style="color: #689d6a;">}</span> <span style="color: #a89984; font-weight: bold;">bundle</span> <span style="color: #458588; font-weight: bold;">agent</span> <span style="color: #458588;">remoteBundle</span> <span style="color: #689d6a;">{</span> <span style="color: #a89984; font-weight: bold;">reports</span>: <span style="color: #689d6a;">"$(myvar)"</span>; <span style="color: #689d6a;">}</span> </pre> </div> <pre class="example" id="org7211a8c"> error: Ignoring remotely-injected variable 'myvar' error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Ignoring remotely-injected variable 'myvar' error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 error: Remote bundle variable injection detected! error: Variable identifier 'remoteBundle.myvar' is not legal error: Promise belongs to bundle 'main' in file '/tmp/example.cf' near line 5 R: $(remoteBundle.myvar) </pre> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups "help-cfengine" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an email to <a href="mailto:[email protected]">[email protected]</a>.<br /> To view this discussion visit <a href="https://groups.google.com/d/msgid/help-cfengine/87bjop8dkx.fsf%40northern.tech?utm_medium=email&utm_source=footer">https://groups.google.com/d/msgid/help-cfengine/87bjop8dkx.fsf%40northern.tech</a>.<br /> --==-=-=-- --=-=-= Content-Type: text/plain; charset="UTF-8" -- Nick Anderson | Doer of Things | (+1) 785-550-1767 | https://northern.tech -- You received this message because you are subscribed to the Google Groups "help-cfengine" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/help-cfengine/87bjop8dkx.fsf%40northern.tech. --=-=-=--