From b2c153b6ff070d620d47c83265992f7226646ee8 Mon Sep 17 00:00:00 2001 From: Gabriel Nagy Date: Tue, 13 Aug 2019 12:41:03 +0300 Subject: (MODULES-9578) Create authorized_key in root path Previously, when the `target` property was set, the ssh_authorized_key resource could not create directories/files within root-owned paths. This behavior is due to the module switching context to the user, then attempting to create the directory/file as the specified user, ultimately failing because of insufficient permissions. This commit adds a new parameter, `drop_privileges` which when set to false allows the module to write a ssh_authorized_key file in a privileged path. Due to the possible security implications of this, the parameter must be manually specified in order to activate this functionality. A path is considered to be privileged/trusted if all of its ancestors: - do not contain any symlinks - have the same owner as the user who runs Puppet - are not world/group writable --- spec/unit/type/ssh_authorized_key_spec.rb | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) (limited to 'spec/unit') diff --git a/spec/unit/type/ssh_authorized_key_spec.rb b/spec/unit/type/ssh_authorized_key_spec.rb index 866c688..457537c 100644 --- a/spec/unit/type/ssh_authorized_key_spec.rb +++ b/spec/unit/type/ssh_authorized_key_spec.rb @@ -17,7 +17,7 @@ describe Puppet::Type.type(:ssh_authorized_key), unless: Puppet.features.microso end describe 'when validating attributes' do - [:name, :provider].each do |param| + [:name, :provider, :drop_privileges].each do |param| it "has a #{param} parameter" do expect(described_class.attrtype(param)).to eq :param end @@ -56,6 +56,28 @@ describe Puppet::Type.type(:ssh_authorized_key), unless: Puppet.features.microso end end + describe 'for drop_privileges' do + it 'uses true as a default value' do + expect(described_class.new(name: 'whev', user: 'nobody')[:drop_privileges]).to eq true + end + + [true, :true, 'true', :yes, 'yes'].each do |value| + it "supports #{value} and returns a boolean true" do + expect(described_class.new(name: 'whev', user: 'nobody', drop_privileges: value)[:drop_privileges]).to eq true + end + end + + [false, :false, 'false', :no, 'no'].each do |value| + it "supports #{value} and returns a boolean false" do + expect(described_class.new(name: 'whev', user: 'nobody', drop_privileges: value)[:drop_privileges]).to eq false + end + end + + it 'raises an exception on something else' do + expect { described_class.new(name: 'whev', user: 'nobody', drop_privileges: 'nope') }.to raise_error(Puppet::Error, %r{Invalid value}) + end + end + describe 'for type' do [ :'ssh-dss', :dsa, -- cgit v1.2.3