Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3006.x] Update 3006 packaging to reduce permissions given to salt user for running salt-master #64194

Merged
merged 23 commits into from
Aug 16, 2023
Merged

[3006.x] Update 3006 packaging to reduce permissions given to salt user for running salt-master #64194

merged 23 commits into from
Aug 16, 2023

Commits on Aug 16, 2023

  1. Update packages for python modules owned by root 

    Updates Debian and RPM packages so that /opt/saltstack/salt and the
python packages don't have to be owned by salt user.

It shouldn't be necessary for salt user, used to run salt-master to be
able to write/modify files in that directory hierarchy.

Add postinst scripts to call the python compileall module to create
byte-compiled python modules. This should preserve performance whilst
not requiring write access for salt user.

Also cleans up .pyc files and __pycache__ dirs on removal.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    8497c40 View commit details
    Browse the repository at this point in the history

  2. Reduce perms for salt user on other salt dirs 

    Reduces the permissions granted to the salt user used to run the
salt-master:

* Under /etc/salt limit ownership to  /etc/salt/pki/master and
  /etc/salt/master.d
* Until saltstack#64219 is resolved also include /etc/salt/minion.d
* Under /var/cache/salt and /var/run/salt only give ownership on
  master directories
* Under /var/log/salt, ensure /var/log/salt/master exists and give
  ownership oof that. Also update logrotate config to create that with
  correct ownership and perms and install that on debian packages.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    14a9496 View commit details
    Browse the repository at this point in the history

  3. Update files to verify in pkg tests 

    Updates lists of files to check in package tests when starting master.
We now set the following as owned by salt:salt in master postinst

* /etc/salt/pki/master
* /etc/salt/master.d
* /var/log/salt/master
* /var/cache/salt/master
* /var/run/salt/master
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    a3ac1f5 View commit details
    Browse the repository at this point in the history

  4. Create /var/run/salt/master 

    Creates /var/run/salt/master directory - if we don't create that
specifically the postinst script will fail
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    ff77232 View commit details
    Browse the repository at this point in the history

  5. Correct docstrings for salt user test_salt_user 

    Corrects docstrings for salt user tests - they were all the same.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    33e283a View commit details
    Browse the repository at this point in the history

  6. Move log creation and chown to posttrans 

    Moves log creation for /var/log/salt/master and /var/log/salt/cloud
and setting ownership to salt:salt to the %posttrans scriplets.
Whilst using %post work fine for fresh installs, upgrading means that
the previous package %postun removes those files. Using %posttrans
ensures the logs are created at the end of the full install/upgrade
transaction.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    2b0e04f View commit details
    Browse the repository at this point in the history

  7. Create empty log for salt-api 

    Creates empty log for salt-api owned by salt user in same way we do for
the master and salt-cloud
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    8f1ee1a View commit details
    Browse the repository at this point in the history

  8. Add tests for package directory and file ownership 

    Adds test that checks that files and directories created by the packages
that should be owned by salt:salt are owned by that user and that the
other files/directories created are owned by root:root.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    3d88f61 View commit details
    Browse the repository at this point in the history

  9. Remove group test for files 

    Removes group test for ownership on files by the salt user. Files that
are created by the salt-master process can be owned by salt:root, rather
than salt:salt and that's valid
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    d2fcd3d View commit details
    Browse the repository at this point in the history

  10. Handle creation of /var/log/salt/key

    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    0c0b3de View commit details
    Browse the repository at this point in the history

  11. Handle pytest-salt-factories permission changes 

    Handles permission changes caused by test suite running as root and
the creation of /var/cache/salt/master/.root_key.

Running the test suite as root means that /etc/salt/pki/master subdirs
get their ownership changed to root - clean that up in conftest.py.
No longer need to fix /var/log/salt as we handle the files in there
individually.

Adds exclusion for /var/cache/salt/master/.root_key as that gets created
by salt* cli tools running as root.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    51ccd20 View commit details
    Browse the repository at this point in the history

  12. Ensure salt-api service is enabled 

    Ensure salt-api service is enabled now we've added a postinst script
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    a9c142a View commit details
    Browse the repository at this point in the history

  13. Removing check on /etc/salt/minion.d 

    Removes check on /etc/salt/minion.d - it's causing issues in CI
that I can't reproduce locally and we'll deal with it in saltstack#64235
anyway.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    2c30824 View commit details
    Browse the repository at this point in the history

  14. Remove some perms checks in conftest.py 

    Remove checks for perms on /var/log/salt/master and /var/run/salt/master
in the salt_master fixture as they may not existing during an upgrade
test and it's not critical to test them in the fixture.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    d362fdc View commit details
    Browse the repository at this point in the history

  15. Add support for fixing old pkg perms 

    Adds support for fixing old package (3006.0/3006.1) perms that used the
salt user too widely.
Without doing this, tests don't pass for upgrades.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    3630b28 View commit details
    Browse the repository at this point in the history

  16. Fix call to sys.stdout.flush()

    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    b5494f7 View commit details
    Browse the repository at this point in the history

  17. Calculaate python version

    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    d48afd9 View commit details
    Browse the repository at this point in the history

  18. Return paths without setting var

    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    1dcf643 View commit details
    Browse the repository at this point in the history

  19. Revert to not hardcoding python version in cloud deploy path

    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    ed82030 View commit details
    Browse the repository at this point in the history

  20. Remove seperate salt-cloud path tests 

    Removes seperate salt-cloud path tests as they are now covered by
test_pkg_paths
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    1e659ea View commit details
    Browse the repository at this point in the history

  21. Add changelog

    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    afdced0 View commit details
    Browse the repository at this point in the history

  22. Don't change ownership of /etc/salt/minion.d 

    No longer changes ownership of /etc/salt/minion.d to salt user for the
salt-master. Requires saltstack#64219 to be resolved.
    @barneysowood
    barneysowood committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    607a4de View commit details
    Browse the repository at this point in the history

  23. Fix test_pip_non_root

    MKLeb committed Aug 16, 2023
    Configuration menu
    Copy the full SHA
    cdd4fec View commit details
    Browse the repository at this point in the history