Fix cmd.script runas for Windows #36520
Conversation
| cwd = os.path.join(__opts__['cachedir'], 'wintmp') | ||
| if not os.path.isdir(cwd): | ||
| __salt__['file.mkdir'](root) | ||
| ret = __salt__['win_dacl.add_ace']( |
There was a problem hiding this comment.
This ret appears to be unused after assignment.
| @@ -2004,6 +2004,14 @@ def _cleanup_tempfile(path): | |||
| # Backwards compatibility | |||
| saltenv = __env__ | |||
|
|
|||
| if salt.utils.is_windows() and runas and cwd is None: | |||
| cwd = os.path.join(__opts__['cachedir'], 'wintmp') | |||
There was a problem hiding this comment.
If it's truly necessary to apply directory permissions to an entire directory just for the sake of being able to one execute one file, I think that we should take the extra step of giving each script its own directory. What do you think about randomizing a directory name per-script and then caching the script there?
|
@cachedout Did you get a chance to look at the change? |
|
Keep in mind if you have access to edit script.bat, you can change it while the script is running. So a long running script gives time to inject commands. I am surprised the runas user can get into cache directory. e.g. might be an admin on the Windows Server, I can run salt highstates, which would have the password, wait for the file to be created, and gain access to user id I would not normally have access too. |
What does this PR do?
Fixes problem with ``cmd.script` when the runas parameter is set in Windows.
What issues does this PR fix or reference?
#33761
Previous Behavior
The default Temp directory for Windows us something like
C:\Users\Joe\AppData\Local\Temp. Thecmd.scriptcopies the script down to the temporary folder using a randomized file name. Then it executes the script. The problem is that therunasuser doesn't have permissions to the TEMP directory of the process that cached the file... so it can't run it.New Behavior
For Windows, with
runas, andcwdnot set, the file will be copied to the file_cache. The folder permissions will be set to allow that user to read and execute within that directory. The`runas`` user can now access the script.Tests written?
No