Improving check-profile

[joseivanlopez]

Problem

A new check-profile command was recently added. This command is intended to check an AutoYaST profile without applying changes to the system. Generally, such a check could be done without root permissions, but there are some situations where root permissions are required:

• With option run-scripts=true, if the script code requires root permissions.
• With an ERB profile, if the ERB code requires root permissions.
• With option import-all=true, if any of the imported modules requires probing.

Running scripts/ERB code as root could lead to security problems, see:

• https://gist.github.com/lslezak/26b6ceb1e340c7216106bd43c5748b86.
• https://bugzilla.suse.com/show_bug.cgi?id=1177123

Solution

It is difficult (or almost impossible) to know in advance if the command will require root access. The only way to ensure that the check will no fail because the permissions would be:

• By requiring root when run-scripts=true or import-all=true or the profile is an ERB. But this can be overkill in situations where the script/erb/probing does not require root.
• By executing YaST in a sandboxed environment (docker, namespaces) in order to avoid changes in the system. But it could have several implications and, at this moment, YaST is not well prepared for it.

It was agreed with security team to go with the following solution:

• Extend the command help with the implications of executing it as root.
• Add a new run-erb option in order to explicitly indicate that you want to execute the ERB. This option is mandatory if the profile is an ERB file and the check is executed as root.

Testing

• Added unit tests
• Manually tested

[coveralls]

Coverage increased (+0.2%) to 65.78% when pulling 979ef7b on joseivanlopez:root_warning into b43c13b on yast:master.

[imobachgs]

It looks (almost) good. Just a comment about the option description.

[yast-bot]

❌ Internal Jenkins job #111 failed

[yast-bot]

✔️ Public Jenkins job #197 successfully finished

[mvidner]

The user facing documentation is at https://documentation.suse.com/sles/15-SP3/single-html/SLES-autoyast/#check-profile

[mvidner]

My plan is to extend the doc-sle section Checking a control file (source)

1. adding a note about run-erb
2. removing the sudo and explaining when it is needed

But now while testing it on SP3 I have found that (2.) is currently pointless as it never works without root, because get_file_from_url wants to mkdir -p /run/YaST2/mount but a user cannot write in /run. It works if you first run it as root, because the dirs are not removed.

/usr/sbin/yast autoyast check-profile filename=/vagrant/opensuse_minimal.xml output=check-profile-output.xml

test file: https://github.com/os-autoinst/os-autoinst-distri-opensuse/blob/master/data/autoyast_opensuse/opensuse_minimal.xml