Skip to content

Fix cron module logic regarding working from non-root user#51873

Merged
garethgreenaway merged 9 commits intosaltstack:2018.3from
Oloremo:cron-module-fix-for-non-root-execution
Apr 29, 2019
Merged

Fix cron module logic regarding working from non-root user#51873
garethgreenaway merged 9 commits intosaltstack:2018.3from
Oloremo:cron-module-fix-for-non-root-execution

Conversation

@Oloremo
Copy link
Contributor

@Oloremo Oloremo commented Feb 27, 2019

What does this PR do?

Fix cron module\state execution in case of Salt running from non-root user

What issues does this PR fix or reference?

Fixes #51872

Previous Behavior

cron state trying to run commands using the privilege escalation via runas arg in different modules.

New Behavior

If the current Salt process owner UID equals specified user in cron state it won't do a privilege escalation.

Tests written?

No

Commits signed with GPG?

Yes

@garethgreenaway
Copy link
Contributor

@Oloremo Thanks for the PR. I think it might make more sense to break out the other if...else situations as you did for the raw_cron function in the others, to ensure that the Solaris/AIX functionality remains consistent.

@Oloremo
Copy link
Contributor Author

Oloremo commented Feb 27, 2019

@garethgreenaway I felt like I didn't break any logic and raw_cron func is just a bit different from the other, but if you like I can make them in the same style

@Oloremo
Copy link
Contributor Author

Oloremo commented Mar 1, 2019

Ok, so I tried to do some unification of the logic and updated tests according to it.
Problem is now I have new kind of condition which isn't covered by tests - when I check if salt running from a root user:

_check_instance_uid_match('root'):

And I'm not sure how to mock it properly to test this condition.

The second problem I hesitated to remove the final else and commented it with
# Edge cases here, let's try do a runas but in fact, I'm pretty sure that if the user hit this condition - it will result in an error since it's not the same user and not the root user so in that case we probably don't have enough permissions to do this operation anyway.

@Oloremo
Copy link
Contributor Author

Oloremo commented Mar 13, 2019

@garethgreenaway mind to look at this PR again?

@dwoz dwoz requested a review from garethgreenaway April 29, 2019 00:58
@garethgreenaway garethgreenaway merged commit a0bb6a4 into saltstack:2018.3 Apr 29, 2019
@Oloremo Oloremo deleted the cron-module-fix-for-non-root-execution branch April 29, 2019 09:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants