Re: cfexecd and chmod($input_dir)

[Mark . Burgess]

As skaar pointed out, you shouldn't be editing the files in
the trusted directory directly anyway. They are intended
as a copy of a different location. Just implement your
desired policy outside of cfengine's domain. The point of
the restrictions is to make cfengine easier to install.

M

On  8 Jun, Will Lowe wrote:
> It's not a huge issue in my environment -- I just have some error
> reporting that parses the outputs/ logs and kept telling me that
> directories were changing permissions.
> 
> But it does seem like 0700 is a very restricted definition of
> "trusted", and it doesn't let the local admin define and enforce local
> policies, which is what cfengine is all about.
> 
> On Tue, Jun 08, 2004 at 11:47:38AM -0500, Chip Seraphine wrote:
>> I have the same problem.  I wanted mine to be 1770 in order to allow 
>> sysadmins 
>> to set flag files as themselves instead of root (so we could better account 
>> for who did what), but all it did was fight with the hard coded chmod...
>> 
>> On Saturday 05 June 2004 03:12, Mark.Burgess@iu.hio.no wrote:
>> > 
>> > The directory must be trusted. Why do you care?
>> > 
>> > M
>> > 
>> > On  4 Jun, Will Lowe wrote:
>> > > I'm running v 2.1.0p1.
>> > > 
>> > > Why does cfexecd insist on doing chmod($input_dir) whenever it runs?
>> > > There's nothing secret in my cfagent configs, so I had update.conf set
>> > > to set the input dir to 0755.
>> > > 
>> > > Looks like the code is at line 218 in cfexecd.c:
>> > > 
>> > > snprintf(VBUFF,bufsize,"%s/inputs",WORKDIR);
>> > > chmod(VBUFF,0700); 
>> > > snprintf(VBUFF,bufsize,"%s/outputs",WORKDIR);
>> > > chmod(VBUFF,0700);
>> > > 
>> > 
>> > 
>> > 
>> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> > Work: +47 22453272            Email:  Mark.Burgess@iu.hio.no
>> > Fax : +47 22453205            WWW  :  http://www.iu.hio.no/~mark
>> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> > 
>> > 
>> > 
>> > _______________________________________________
>> > Help-cfengine mailing list
>> > Help-cfengine@gnu.org
>> > http://lists.gnu.org/mailman/listinfo/help-cfengine
>> > 
>> 
>> -- 
>> 
>> Chip Seraphine
>> Unix Administrator
>> TradeLink, LLC
>> 312-264-2048
>> chip@trdlnk.com
>> 
>> 
>> 
>> _______________________________________________
>> Help-cfengine mailing list
>> Help-cfengine@gnu.org
>> http://lists.gnu.org/mailman/listinfo/help-cfengine
> 



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Work: +47 22453272            Email:  Mark.Burgess@iu.hio.no
Fax : +47 22453205            WWW  :  http://www.iu.hio.no/~mark
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~