From 52c635da2b150ef926cbad35b9ce2228b5d0d5e2 Mon Sep 17 00:00:00 2001
From: Craig Comstock <craig.comstock@northern.tech>
Date: Mon, 24 Nov 2025 09:47:11 -0600
Subject: [PATCH] Fixed cfruncommand for Windows causing "Too many arguments"
 error

The issue was that the entire command line was sent and the '&' which should be a command separator was instead being interpreted as another argument.

This caused the argument parser to try and interpret '&' as the filename as in this special syntax: "cf-agent <policy-file>" and since there is more text after '&' in the existing cfruncommand value the "Too many arguments" error is caused.

Ticket: ENT-13530
Changelog: title
(cherry picked from commit d9238b24b833cc8163b3325f24b26bfa11593b40)
---
 CHANGELOG.md           |  1 +
 controls/cf_serverd.cf | 17 ++++++++++-------
 controls/def.cf        |  6 ++++++
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dce49c9b22..70cf638d0e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,5 @@
 3.21.8:
+	- Fixed cfruncommand for Windows causing "Too many arguments" error (ENT-13530)
 	- Added dmidecode to well known paths for Red Hat (ENT-12988)
 	- Added recommendation about nfs server and consistent use of root dot
 	  (ENT-13223)
diff --git a/controls/cf_serverd.cf b/controls/cf_serverd.cf
index da5fbaba31..71f9d5b987 100644
--- a/controls/cf_serverd.cf
+++ b/controls/cf_serverd.cf
@@ -68,15 +68,18 @@ body server control
 
       allowusers => { @(def.control_server_allowusers) };
 
+    # In 3.10 the quotation is properly closed when EOF is reached. It is left
+    # open so that arguments (like -K and --remote-bundles) can be appended.
+    # 3.10.x does not automatically append -I -Dcfruncommand
+
     windows::
-      cfruncommand => "$(sys.cf_agent) -I -D cf_runagent_initiated -f \"$(sys.update_policy_path)\"  &
-                       $(sys.cf_agent) -I -D cf_runagent_initiated";
 
-    !windows::
+        # /s removes the first and last quote characters and aids in specifying paths with surrounding quotes
+        cfruncommand => "$(def.cf_runagent_shell) /s /c \"
+                           $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  &
+                           $(sys.cf_agent) -I -D cf_runagent_initiated";
 
-      # In 3.10 the quotation is properly closed when EOF is reached. It is left
-      # open so that arguments (like -K and --remote-bundles) can be appended.
-      # 3.10.x does not automatically append -I -Dcfruncommand
+    !windows::
 
         cfruncommand => "$(def.cf_runagent_shell) -c \'
                            $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  ;
@@ -163,7 +166,7 @@ bundle server mpf_default_access_rules()
         shortcut => "hub_cmdb",
         admit_keys => { $(connection.key) };
 
-    !windows::
+    any::
       "$(def.cf_runagent_shell)" -> { "ENT-6673" }
       handle => "server_access_grant_access_shell_cmd",
       comment => "Grant access to shell for cfruncommand",
diff --git a/controls/def.cf b/controls/def.cf
index 6b8c7fbddd..f1a971a8dd 100644
--- a/controls/def.cf
+++ b/controls/def.cf
@@ -452,6 +452,12 @@ bundle common def
         comment => "Define path to shell used by cf-runagent",
         handle  => "common_def_vars_solaris_cf_runagent_shell";
 
+    windows::
+      "cf_runagent_shell"
+        string  => "${sys.winsysdir}${const.dirsep}cmd.exe",
+        comment => "Define path to shell used by cf-runagent",
+        handle  => "common_def_vars_windows_cf_runagent_shell";
+
     !(windows|solaris)::
       "cf_runagent_shell"
         string  => "/bin/sh",