Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #10081: Use rudder agent run as cfruncommand #1111

Conversation

amousset
Copy link
Member

Copy link
Member

@ncharles ncharles left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are some changes needed to make it work

@@ -246,8 +246,9 @@ body server control
# last single quote in cfruncommand is left open, so that
# arguments (like -K and --remote-bundles) are properly appended.
cfruncommand => "${def.cf_runagent_shell} -c \'
${sys.cf_agent} -I -D cfruncommand -f failsafe.cf \&\&
${sys.cf_agent} -I -D cfruncommand";
${g.rudder_command} agent update &&
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you need to backslash the &

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and you will need an access rule for g.rudder_command, like
"$(g.rudder_command)" comment => "Grant access to rudder agent command for cfruncommand", admit => { ${def.policy_server} };

@amousset
Copy link
Member Author

amousset commented Feb 8, 2017

Commit modified

@amousset amousset force-pushed the ust_10081/use_rudder_agent_run_as_cfruncommand branch from 4e03fde to f39400f Compare February 8, 2017 10:57
@amousset
Copy link
Member Author

amousset commented Feb 8, 2017

Commit modified

@amousset amousset force-pushed the ust_10081/use_rudder_agent_run_as_cfruncommand branch from f39400f to 028429b Compare February 8, 2017 10:57
@amousset
Copy link
Member Author

amousset commented Feb 8, 2017

@peckpeck @ncharles Made some important changes:

  • Avoid having to authorize to use a shell (that went against the idea of limiting authorized commands) by calling rudder agent run -u directly
  • Stop conditioning agent execution to policy update success. Do you know what was the point of that?

@@ -114,7 +114,7 @@ bundle server access_rules
admit => { host2ip("${server_info.cfserved}"), string_downcase(escape("${server_info.cfserved}")) };

!windows::
"${def.cf_runagent_shell}"
"${g.rudder_command}" comment => "Grant access to rudder agent command for cfruncommand",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So we won't need the shll anywhere ?

@peckpeck
Copy link
Member

peckpeck commented Feb 8, 2017

I think it was because if download fails, promises are probably not up to date.
But running rudder anyway is closer to hat we expect

@amousset
Copy link
Member Author

Commit modified

@amousset amousset force-pushed the ust_10081/use_rudder_agent_run_as_cfruncommand branch from 028429b to 6dc112d Compare February 10, 2017 14:23
@amousset
Copy link
Member Author

ping @peckpeck

@amousset
Copy link
Member Author

Commit modified

@amousset amousset force-pushed the ust_10081/use_rudder_agent_run_as_cfruncommand branch from 6dc112d to b455281 Compare February 10, 2017 15:26
@Normation-Quality-Assistant
Copy link
Contributor

OK, merging this PR

@Normation-Quality-Assistant Normation-Quality-Assistant merged commit b455281 into Normation:branches/rudder/4.1 Feb 10, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
4 participants