-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Default policies don't work out of the box. #41
Comments
The necessary fixes are in https://github.com/cfengine/masterfiles but not core.git (since
My personal preference is to use https://github.com/cfengine/masterfiles but I can see the risk in that approach, so let me know what you think. |
I just did some tests and
I deleted the symlink and make inputs a real directory and everything work as expected. |
Could we use a hard link instead of a symlink? |
no unix handbook -) Hardlinks does not work for different filesystems On 28 okt. 2013, at 14:09, Ted Zlatanov notifications@github.com wrote:
SURFsara has a new telephone number: +31 20 800 1300. Bas van der Vlies |
@tzz it is cfengine that prevents this |
OK, my earlier comment about general direction is still standing. How are we going to patch these cases in general? For this one specifically, I think |
We have to ask the debian maintainers if we van use this approach. Link /etc/cfengine to sys.workdir/inputs. There are several debian packages that do the reverse approach:
else we have to modify the generated failsafe.code to see if sys.workdir/inputs is a symbolic link or real directory. |
@tzz maybe this is the solution. the |
Can you suggest what files need to be patched and how? I'm not sure I understand the right solution. |
This email was not archived:
|
I think that the issue of It's done that way to help comply with Debian policy, but it clearly doesn't work. So we need something different. My proposal would be to leave |
sys.workdir/inputs can now be a symlink to a directory in the cfengine core. See: I will merge pull request: #42 |
Will this work for masterfiles as well? |
It works for all symlinked directories On 29 okt. 2013, at 08:59, Brian Bennett notifications@github.com wrote:
SURFsara has a new telephone number: +31 20 800 1300. Bas van der Vlies |
Is this fixed, then? |
I don't know if all of the usage cases have been tested. I'd like to keep this open until each one is checked off. |
@basvandervlies @bahamat @vohi does cfengine/core#1050 need to be backported to 3.5.x? If so I can open the PR+ticket. |
@tzz That would be nice +1. |
@bahamat, @tzz and others. Due this project i am testing the bootstrap procedure. Correct me if i am wrong but this will only work if the client and policy_server uses the same sys.workdir. So our debian package can never use the bootstrap procedure if the policy server uses other sys.workdir. This is due the generated '''failsafe.cf'''. |
@bahamat @tzz the patch is reverted due to security issues: cfengine/core#1050. So we have also to delete the patch and make '''/etc/cfengine'' to '''sys.workdir/inputs'''. Then everything works as expected. |
To prevent the symlink attack i just submitted a pull request: #50 I am still in favor of reverting the symlink:
I do not know if this acceptable according the Debian package policies. |
Mark Simons just had hangout with Mark Burgess and he is in favor of /etc/cfengine3 ---> sys,workdir/inputs. So one of the debian package developers have to ask if this acceptable. If this acceptable then we have a working bootstrap. |
@basvandervlies can you please explain exactly what is the proposed solution? I think you're proposing a symlink but it's hard to tell. |
@tzz Your right it is a symlink ;-) from /etc/cfengine3 to sys.workdir/inputs. Debian sys.workdir=/var/lib/cfengine3. |
I understand. So Debian will have to find the symlink acceptable and we'll wait for their decision, probably from Antonio? |
@tzz yes we have to wait for Antonio's answer and provide a mechanism for the transition from old to new situation. remove the the sysmlink sys,workdir/inputs, copy /etc/cfengine3 to sys.workdir/inputs and make the symlink. |
There is a pull request cfengine/core#1260 that add two configure options:
This is will solve the /etc/cfengine3 symbolic issue with bootstrap on the client |
cfengine/core#1260 is merged :) |
@tzz Thanks for the support!!! We have to wait fot 3.6 ;-) |
The masterdir/inputdir is now merge cfengine/core/#1293. So one hurdle to go |
This can be reconciled with a shortcut promise. |
This also applies to the masterfiles package, so removing blocker tag. |
|
The following cases should work:
The text was updated successfully, but these errors were encountered: