File 0043-Add-roster-disable-flag.patch of Package salt

Overview Repositories Revisions Requests Users Attributes Meta

File 0043-Add-roster-disable-flag.patch of Package salt (Revision 456326f167acd743cd057c714fee7cf0)

Currently displaying revision 456326f167acd743cd057c714fee7cf0 , Show latest

From 5f7e23fc3456c0903cb26c05c7f428d4b221df45 Mon Sep 17 00:00:00 2001
From: Bo Maryniuk <bo@suse.de>
Date: Thu, 5 Jan 2017 19:09:17 +0100
Subject: [PATCH 43/43] Add roster disable flag

* Disable custom rosters in API
    * Pick up a specified roster file from the configured locations
    * Explain what it is about and how to configure that
    * Add docstring
    * Add explanation comment
    * Lintfix
---
 conf/master               | 11 +++++++++++
 salt/client/ssh/client.py |  6 +++++-
 salt/netapi/__init__.py   |  3 ++-
 salt/roster/__init__.py   | 42 +++++++++++++++++++++++++++++++++---------
 4 files changed, 51 insertions(+), 11 deletions(-)

diff --git a/conf/master b/conf/master
index 68d3bb0043..cd4b4bfd76 100644
--- a/conf/master
+++ b/conf/master
@@ -358,6 +358,17 @@ syndic_user: salt
 # Pass in an alternative location for the salt-ssh roster file
 #roster_file: /etc/salt/roster
 
+# Define a locations for roster files so they can be chosen when using Salt API.
+# An administrator can place roster files into these locations. Then when
+# calling Salt API, parameter 'roster_file' should contain a relative path to
+# these locations. That is, "roster_file=/foo/roster" will be resolved as
+# "/etc/salt/roster.d/foo/roster" etc. This feature prevents passing insecure
+# custom rosters through the Salt API.
+#
+#rosters:
+# - /etc/salt/roster.d
+# - /opt/salt/some/more/rosters
+
 # Pass in minion option overrides that will be inserted into the SHIM for
 # salt-ssh calls. The local minion config is not used for salt-ssh. Can be
 # overridden on a per-minion basis in the roster (`minion_opts`)
diff --git a/salt/client/ssh/client.py b/salt/client/ssh/client.py
index 8bac430a96..675815878b 100644
--- a/salt/client/ssh/client.py
+++ b/salt/client/ssh/client.py
@@ -22,7 +22,8 @@ class SSHClient(object):
     '''
     def __init__(self,
                  c_path=os.path.join(syspaths.CONFIG_DIR, 'master'),
-                 mopts=None):
+                 mopts=None,
+                 disable_custom_roster=False):
         if mopts:
             self.opts = mopts
         else:
@@ -35,6 +36,9 @@ class SSHClient(object):
                 )
             self.opts = salt.config.client_config(c_path)
 
+        # Salt API should never offer a custom roster!
+        self.opts['__disable_custom_roster'] = disable_custom_roster
+
     def _prep_ssh(
             self,
             tgt,
diff --git a/salt/netapi/__init__.py b/salt/netapi/__init__.py
index 69f6f95ae2..15c6ba39ab 100644
--- a/salt/netapi/__init__.py
+++ b/salt/netapi/__init__.py
@@ -119,7 +119,8 @@ class NetapiClient(object):
 
         :return: Returns the result from the salt-ssh command
         '''
-        ssh_client = salt.client.ssh.client.SSHClient(mopts=self.opts)
+        ssh_client = salt.client.ssh.client.SSHClient(mopts=self.opts,
+                                                      disable_custom_roster=True)
         return ssh_client.cmd_sync(kwargs)
 
     def ssh_async(self, fun, timeout=None, **kwargs):
diff --git a/salt/roster/__init__.py b/salt/roster/__init__.py
index 77ef61b29d..74121351b8 100644
--- a/salt/roster/__init__.py
+++ b/salt/roster/__init__.py
@@ -19,19 +19,43 @@ log = logging.getLogger(__name__)
 
 
 def get_roster_file(options):
-    if options.get('roster_file'):
-        template = options.get('roster_file')
-    elif 'config_dir' in options.get('__master_opts__', {}):
-        template = os.path.join(options['__master_opts__']['config_dir'],
-                                'roster')
-    elif 'config_dir' in options:
-        template = os.path.join(options['config_dir'], 'roster')
-    else:
-        template = os.path.join(salt.syspaths.CONFIG_DIR, 'roster')
+    '''
+    Find respective roster file.
+
+    :param options:
+    :return:
+    '''
+    template = None
+    # The __disable_custom_roster is always True if Salt SSH Client comes
+    # from Salt API. In that case no way to define own 'roster_file', instead
+    # this file needs to be chosen from already validated rosters
+    # (see /etc/salt/master config).
+    if options.get('__disable_custom_roster') and options.get('roster_file'):
+        roster = options.get('roster_file').strip('/')
+        for roster_location in options.get('rosters'):
+            r_file = os.path.join(roster_location, roster)
+            if os.path.isfile(r_file):
+                template = r_file
+                break
+        del options['roster_file']
+
+    if not template:
+        if options.get('roster_file'):
+            template = options.get('roster_file')
+        elif 'config_dir' in options.get('__master_opts__', {}):
+            template = os.path.join(options['__master_opts__']['config_dir'],
+                                    'roster')
+        elif 'config_dir' in options:
+            template = os.path.join(options['config_dir'], 'roster')
+        else:
+            template = os.path.join(salt.syspaths.CONFIG_DIR, 'roster')
 
     if not os.path.isfile(template):
         raise IOError('No roster file found')
 
+    if not os.access(template, os.R_OK):
+        raise IOError('Access denied to roster "{0}"'.format(template))
+
     return template
 
 
-- 
2.11.0

Places

File 0043-Add-roster-disable-flag.patch of Package salt (Revision 456326f167acd743cd057c714fee7cf0)

Places