salt-ssh temporary files - insecure permissions

[afletch]

When salt-ssh sets up it's temporary location (eg. /var/tmp/.root_xxxx_salt), the files contained (eg. /var/tmp/.root_xxxx_salt/running_data/var/cache/salt/minion/files) are 0644. Some of these files may well contain sensitive data such as private keys (which when installed will be set to 0600 by the state).

The permissions may be inherited from the salt-master, but if these files come from a backend such as gitfs, they seem to have 0644 in the master gitfs cache (which in itself is a problem!)

Run the following state with salt-ssh and check the files located in the temporary directory on the remote host. The mykey.key file will be

/etc/pki/tls/private/mykey.key:
  file.managed:
    - source: salt://mystate/files/ssl/mykey.key
    - mode: 0600
    - user: root
    - group: root 

Salt Version:
           Salt: 2016.11.1

Dependency Versions:
           cffi: 1.6.0
       cherrypy: 3.2.2
       dateutil: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.7.2
        libgit2: 0.25.1
        libnacl: Not Installed
       M2Crypto: 0.21.1
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.8
   mysql-python: Not Installed
      pycparser: 2.14
       pycrypto: 2.6.1
         pygit2: 0.25.0
         Python: 2.7.5 (default, Nov  6 2016, 00:28:07)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 15.3.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: centos 7.3.1611 Core
        machine: x86_64
        release: 3.10.0-229.4.2.el7.x86_64
         system: Linux
        version: CentOS Linux 7.3.1611 Core

[Ch3LL]

@afletch looks like i'm able to replicate this behavior on 2016.11.3 and the head of 2016.11. I was not able to replicate this on the head of 2016.3 branch and v2016.3.5 so its good there. We will need to get this fixed thanks.

[cachedout]

@gtmanfred I have assigned this over to you. Please also ensure that a test is written for this so that it does not regress prior to closing this.

[gtmanfred]

This is going to require some reworking of how the fileclient works.

Because of the change made here, 73a156d

We mirror the file permissions down to the minion so that we can keep the same permissions as the fileserver if the mode and owner/group are not set.

[terminalmage]

It's not that we mirror the mode when not set, it's when explicitly configured to do so using keep as the mode.

[terminalmage]

When no mode is set, we let the system umask decide.

[gtmanfred]

This should be fixed by PR #40609

It does mean that we cannot use the mode: keep when using salt-ssh.

Thanks,
Daniel

[Ch3LL]

Closing since this has been resolved.

[msmeissn]

assigned CVE-2017-8109.