Skip saltutil runner/wheel privilege drop on invalid user (#69833) - #69923
Open
dwoz wants to merge 1 commit into
Open
Skip saltutil runner/wheel privilege drop on invalid user (#69833)#69923dwoz wants to merge 1 commit into
dwoz wants to merge 1 commit into
Conversation
state.orchestrate overwrites __opts__["user"] with __user__ (the publishing user, which is either salt.utils.user.get_specific_user() -> "sudo_<login>" under sudo, or the reactor's "Reactor" sentinel when the orchestration was triggered by a reactor). The post-saltstack#67716 privilege-drop path in saltutil.runner/saltutil.wheel reads that value as the runas target and asks chugid to switch to it, which then raises KeyError from pwd.getpwnam wrapped in CommandExecutionError: Failed to run 'cache.grains' as user 'sudo_alice': KeyError: "getpwnam(): name not found: 'sudo_alice'" Failed to run 'queue.insert' as user 'Reactor': KeyError: "getpwnam(): name not found: 'Reactor'" Validate the candidate against the passwd database in _master_user_runas and skip the privilege drop when it does not resolve to a real account, falling back to historical in-process behavior. Merge-forward of saltstack#69609 (which landed on 3006.x/3007.x for saltstack#69600) plus a regression test for the reactor variant. Fixes saltstack#69833
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Merge-forward of #69609 (landed on 3006.x/3007.x for #69600) plus a regression test for the reactor variant.
state.orchestrateoverwrites__opts__["user"]with__user__-- the reactor stamps"Reactor"there, and sudo-launchedsalt-runsets"sudo_<login>". Neither is a real UNIX account, so the post-#67716 privilege-drop path crashes inpwd.getpwnaminsidechugid:_master_user_runasnow validates the candidate against the passwd database and returnsNonewhen it doesn't resolve, falling back to the historical in-process behavior.Previous Behavior
saltutil.runner/saltutil.wheelinvoked from a reactor-triggered orchestration crash withKeyErrorfromgetpwnam("Reactor").New Behavior
_master_user_runasskips the privilege drop whenopts["user"]is not a real system account. Runner/wheel fall back to running in-process (the pre-#67716 behavior).Merge Requirements Satisfied?
changelog/69833.fixed.md, plus the merge-forwardedchangelog/69600.fixed.md).test_master_user_runas_reactor_sentinel_returns_none).Fixes #69833