saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fix master pull socket permissions

Browse source
This commit is contained in:
Daniel A. Wozniak 2024-08-13 15:46:22 -07:00 • committed by Daniel Wozniak
parent bd89384259
commit 411c1f384e
4 changed files with 30 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
salt/transport/base.py
View file

@ -233,6 +233,7 @@ def ipc_publish_server(node, opts):
kwargs.update(
pub_path=os.path.join(opts["sock_dir"], "master_event_pub.ipc"),
pull_path=os.path.join(opts["sock_dir"], "master_event_pull.ipc"),
pub_path_perms=0o660,
)
else:
id_hash = _minion_hash(

12
salt/transport/tcp.py
View file

@ -10,6 +10,7 @@ import asyncio.exceptions
import errno
import logging
import multiprocessing
import os
import queue
import select
import socket
@ -1327,6 +1328,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
pull_host=None,
pull_port=None,
pull_path=None,
pull_path_perms=0o600,
pub_path_perms=0o600,
ssl=None,
):
self.opts = opts
@ -1337,6 +1340,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
self.pull_host = pull_host
self.pull_port = pull_port
self.pull_path = pull_path
self.pull_path_perms = pull_path_perms
self.pub_path_perms = pub_path_perms
self.ssl = ssl
@property
@ -1355,6 +1360,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
"pull_host": self.pull_host,
"pull_port": self.pull_port,
"pull_path": self.pull_path,
"pub_path_perms": self.pub_path_perms,
"pull_path_perms": self.pull_path_perms,
}
def publish_daemon(
@ -1406,7 +1413,9 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
log.debug(
"Publish server binding pub to %s ssl=%r", self.pub_path, self.ssl
)
sock = tornado.netutil.bind_unix_socket(self.pub_path)
with salt.utils.files.set_umask(0o177):
sock = tornado.netutil.bind_unix_socket(self.pub_path)
os.chmod(self.pub_path, self.pub_path_perms)
else:
log.debug(
"Publish server binding pub to %s:%s ssl=%r",
@ -1446,6 +1455,7 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
# Securely create socket
with salt.utils.files.set_umask(0o177):
self.pull_sock.start()
os.chmod(self.pull_path, self.pull_path_perms)
def pre_fork(self, process_manager):
"""

14
salt/transport/ws.py
View file

@ -1,6 +1,7 @@
import asyncio
import logging
import multiprocessing
import os
import socket
import time
import warnings
@ -259,6 +260,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
pull_host=None,
pull_port=None,
pull_path=None,
pull_path_perms=0o600,
pub_path_perms=0o600,
ssl=None,
):
self.opts = opts
@ -268,6 +271,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
self.pull_host = pull_host
self.pull_port = pull_port
self.pull_path = pull_path
self.pull_path_perms = pull_path_perms
self.pub_path_perms = pub_path_perms
self.ssl = ssl
self.clients = set()
self._run = None
@ -291,6 +296,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
"pull_host": self.pull_host,
"pull_port": self.pull_port,
"pull_path": self.pull_path,
"pull_path_perms": self.pull_path_perms,
"pub_path_perms": self.pub_path_perms,
}
def publish_daemon(
@ -338,8 +345,10 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
server = aiohttp.web.Server(self.handle_request)
runner = aiohttp.web.ServerRunner(server)
await runner.setup()
site = aiohttp.web.UnixSite(runner, self.pub_path, ssl_context=ctx)
log.info("Publisher binding to socket %s", self.pub_path)
with salt.utils.files.set_umask(0o177):
log.info("Publisher binding to socket %s", self.pub_path)
site = aiohttp.web.UnixSite(runner, self.pub_path, ssl_context=ctx)
os.chmod(self.pub_path, self.pub_path_perms)
else:
sock = _get_socket(self.opts)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
@ -360,6 +369,7 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
self.puller = await asyncio.start_unix_server(
self.pull_handler, self.pull_path
)
os.chmod(self.pull_path, self.pull_path_perms)
else:
self.puller = await asyncio.start_server(
self.pull_handler, self.pull_host, self.pull_port

8
salt/transport/zeromq.py
View file

@ -852,6 +852,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
pull_host=None,
pull_port=None,
pull_path=None,
pull_path_perms=0o600,
pub_path_perms=0o600,
):
self.opts = opts
self.pub_host = pub_host
@ -864,6 +866,8 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
self.pull_host = pull_host
self.pull_port = pull_port
self.pull_path = pull_path
self.pub_path_perms = pub_path_perms
self.pull_path_perms = pull_path_perms
if pull_path:
self.pull_uri = f"ipc://{pull_path}"
else:
@ -930,14 +934,14 @@ class PublishServer(salt.transport.base.DaemonizedPublishServer):
if self.pub_path:
os.chmod( # nosec
self.pub_path,
0o600,
self.pub_path_perms,
)
log.info("Starting the Salt Puller on %s", self.pull_uri)
pull_sock.bind(self.pull_uri)
if self.pull_path:
os.chmod( # nosec
self.pull_path,
0o600,
self.pull_path_perms,
)
return pull_sock, pub_sock, monitor