Puppet

Luke?

Seems like a bug to me, and the code looks right but I wouldn’t merge it without a good bit of testing.

I’ve applied the patches cleanly but now I get the following which I believe is due to a typo introduced on line 32, where I believe it’s missing a comma. After adding a comma it runs but tells me that it cannot change to user 100, puppet’s uid on my system.

Starting puppetmaster: /usr/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `gem_original_require': /usr/lib/ruby/site_ruby/1.8/puppet/util/suidmanager.rb:32: syntax error (SyntaxError)
            self.initgroups(convert_xid :gid new_uid) if new_uid
                                                    ^
/usr/lib/ruby/site_ruby/1.8/puppet/util/suidmanager.rb:69: syntax error
/usr/lib/ruby/site_ruby/1.8/puppet/util/suidmanager.rb:76: syntax error from /usr/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:27:in `require'
        from /usr/lib/ruby/site_ruby/1.8/puppet.rb:17
        from /usr/sbin/puppetmasterd:83:in `require'
        from /usr/sbin/puppetmasterd:83

Bumped since no progress and no tests.

Here is a reworked patch, that should work better. It allows me to start puppetmaster and it has to correct groups afterwards. I did not yet test more. It also makes the error message if chuser fails verbose, it is now similiar to the warning when changing the group fails.

Luke? Thoughts? Still no tests obviously but your feedback on the patch would be good. I’ll send to the list for comment.

Btw. if you need some test procedure to understand why the current beheaviour is bad, use this one:

Steps to Reproduce: 1. # service puppetmaster start 2. # cat /proc/$(ps —User puppet -o pid | tail -n 1)/status | grep Group

Actual results: The output matches “id -G root”.

Expected results: The output should match “id -G puppet”, i.e. the process should run with the supplementary groups of puppet.

The default supplementary groups of root include the group disk, which e.g. provides raw read access on disk devices.

This works on a Fedora or CentOS system. Fedora bug report: https://bugzilla.redhat.com/show_bug.cgi?id=475201

This works on a Fedora or CentOS system. Fedora bug report: https://bugzilla.redhat.com/show_bug.cgi?id=475201

Works on Debian as well:

% cat /proc/$(ps —User puppet -o pid | tail -n 1)/status | grep Group
Groups: 0

Looks like Fedora released an update for this, perhaps it will get a CVE?

I just wrote a mail to mitre to get a CVE number assigned.

I got this number for this issue: CVE-2009-3564

Till – can you rebase your latest patch please against master.

Till – ignore that I’ve sent your updated patch to the puppet-dev list.

Waiting some feedback on the -dev list.

Pushed in commit:“e32f980fd7c6291abc2841ede397c962798d9a9c” in branch 0.25.x.