access denied by server, but acl's are in def.json

[Xander Cage]

i get the following on the server verbose out...

 debug: 172.17.X.X>    ReceiveTransaction header: t 56....
   debug: 172.17.X.X>    ReceiveTransaction data: SYNCH 1615384168 STAT /cferoot//usr/local/nagios/libexec
 verbose: 172.17.X.X>         Received:    STAT /cferoot//usr/local/nagios/libexec
 verbose: 172.17.X.X>    Translated to:    STAT /cferoot/usr/local/nagios/libexec/
    info: 172.17.X.X>    access denied to STAT: /cferoot/usr/local/nagios/libexec/
   debug: 172.17.X.X>    SendTransaction header: t 59
   debug: 172.17.X.X>    SendTransaction data: BAD: Unspecified server refusal (see verbose server output)
 verbose: 172.17.X.X>    REFUSAL to user='root' of request: SYNCH 1615384168 STAT /cferoot//usr/local/nagios/libexec

but access is definitely granted via def.json acl rules...

"inputs": ["services/autorun/itsv.cf", "itsv/itsv_access_rules.cf"],

"control_server_itsv_acl_rules": {

"/usr/local/bin": { "admit": "def.acl", "comment": "grant access to ulb" },

"/etc/sudoers.d": { "admit": "def.acl", "comment": "grant access to sudoers" },

"/cferoot": { "admit": "def.acl", "comment": "grant access to cferoot" }

}

}

nimvie: /home/tremch/GIT/cfengine_modules # cat /var/cfengine/masterfiles/itsv/itsv_access_rules.cf
bundle server itsv_acl_rules
{

   # this file gets sourced from def.json, so no autorun tag here

   vars:

        "itsv_paths" slist  => getindices( "def.control_server_itsv_acl_rules" );


   access:


     any::

       # -----------------------------------------------------------
       # Custom rules from augments
       # -----------------------------------------------------------
       # https://cmdln.org/2018/07/19/augments-driven-access-promises-with-cfengine-3/

        "$(itsv_paths)"
          comment => "$(def.control_server_itsv_acl_rules[$(itsv_paths)][comment])",
          admit => { "@($(def.control_server_itsv_acl_rules[$(itsv_paths)][admit]))" };



}

 

whats wrong here? is this approach not valid anymore? cfengine is 3.12.5, mpf was upgraded to 3.15.3.

chris

[Xander Cage]

example verbose log from client:

 verbose: File '/etc/itsv-ca-bundle.crt' copy_from '/cferoot/etc/itsv-ca-bundle.crt'
 verbose: FindIdle: no existing connection to '172.17.X.X is established.
 verbose: Connecting to host 172.17.X.X, port 5308 as address 172.17.X.X
 verbose: Waiting to connect...
 verbose: Setting socket timeout to 30 seconds.
 verbose: Connected to host 172.17.X.X address 172.17.X.X port 5308 (socket descriptor 4)
 verbose: TLS version negotiated:  TLSv1.2; Cipher: AES256-GCM-SHA384,TLSv1/SSLv3
 verbose: TLS session established, checking trust...
 verbose: Received public key compares equal to the one we have stored
 verbose: Server is TRUSTED, received key 'MD5=ecafd01a913ec45ec5b9f6f940434bec' MATCHES stored one.
 verbose: Server returned error: Unspecified server refusal (see verbose server output)
    info: Can't stat file '/cferoot/etc/itsv-ca-bundle.crt' on '172.17.X.X' in files.copy_from promise
 verbose: Handling file existence constraints on '/etc/itsv-ca-bundle.crt'
 verbose: A: Promise NOT KEPT!
 verbose: P: END files promise (/etc/itsv-ca-bundle.crt)

[Xander Cage]

new findings:

since upgrading mpf, the contents of masterfiles directory is not (or only partial) copied to inputs directory, even def.json is missing, which might be the root of all this. i copied  def.json to inputs, but it was deleted somehow at server startup.

nimvie: /var/cfengine/masterfiles # /var/cfengine/bin/cf-serverd -vF | grep json
 verbose: Loading JSON augments from '/var/cfengine/inputs/def.json' (input dir '/var/cfengine/inputs', input file '/var/cfengine/inputs/promises.cf'
 verbose: could not load JSON augments from '/var/cfengine/inputs/def.json'
 verbose: Skipping promise 'acl' because constraint 'ifvarclass => and(isvariable("override_data_acl"),"!feature_def_json_preparse")' is not met
 verbose: Skipping promise 'trustkeysfrom' because constraint 'ifvarclass => and(isvariable("override_data_trustkeysfrom"),"!feature_def_json_preparse")' is not met
 verbose: Skipping promise 'acl' because constraint 'ifvarclass => and(isvariable("override_data_acl"),"!feature_def_json_preparse")' is not met
 verbose: Skipping promise 'trustkeysfrom' because constraint 'ifvarclass => and(isvariable("override_data_trustkeysfrom"),"!feature_def_json_preparse")'

nimvie: /var/cfengine/masterfiles # ls

.git                        README_TO_MYSELF            controls                    lib                         standalone_self_upgrade.cf
.gitignore                  cf_promises_release_id      def.json                    promises.cf                 templates
CHANGES.policy              cf_promises_validated       inventory                   services                    update.cf
MPF_VERSION                 cfe_internal                itsv                        sketches

nimvie: /var/cfengine/masterfiles # ls ../inputs/
cfe_internal                inventory                   promises.cf                 standalone_self_upgrade.cf  update.cf
controls                    lib                         services                    templates

[Xander Cage]

ok, the problem is definitely that only parts of masterfiles directory contents are copied over to inputs directory at bootstrap. i have not the slighest clue why. there must be some significant changes in  mpf 3.15.3 which i am not aware of. the clients are able to bootstrap from the server and also updates are propagated to the clients.  i also updated server bins to 3.15.3 but this made no change. i'm completely out of ideas...help.

[Nick Anderson]

Xander Cage <christia...@itsv.at> writes:

ok, the problem is definitely that only parts of masterfiles directory contents are copied over to inputs directory at bootstrap. i have not the slighest clue why. there must be some significant changes in mpf 3.15.3 which i am not aware of. the clients are able to bootstrap from the server and also updates are propagated to the clients. i also updated server bins to 3.15.3 but this made no change. i'm completely out of ideas…help.

Hi Chris,

I haven't read the whole thread, so it's quite possible I missed something but I think this sounds like the Why are some files inside masterfiles not being updated/distributed FAQ. I suspicion that you might want to configure the Files considered for copy durning policy updates.

This isn't something new, it's been around for quite some time but perhaps you had customized the policy and that customization was lost when you upgraded the MPF.

[Xander Cage]

i am aware of that, the patterns are defined in def.json. but not even that is compied over to inputs, which make this somkind of chicken-egg problem.

masterfiles directory:

nimvie: /var/cfengine/masterfiles # ls

.git                        README_TO_MYSELF            controls                    lib                         standalone_self_upgrade.cf
.gitignore                  cf_promises_release_id      def.json                    promises.cf                 templates
CHANGES.policy              cf_promises_validated       inventory                   services                    update.cf
MPF_VERSION                 cfe_internal                itsv                        sketches

inputs directory after bootstrap (notice the missing files AND directories and no def.json):

nimvie: /var/cfengine/masterfiles # ls ../inputs/
cfe_internal                inventory                   promises.cf                 standalone_self_upgrade.cf  update.cf
controls                    lib                         services                    templates

[Nick Anderson]

Xander Cage <christia...@itsv.at> writes:

i am aware of that, the patterns are defined in def.json. but not even that is compied over to inputs, which make this somkind of chicken-egg problem.

Are any changes deployed to masterfiles propagated to remote agent inputs?

echo "# Vin Diesel wasn't here" >> /var/cfengine/mastefiles/promises.cf

Does that end up on the clients?

FAQ: [[https://docs.cfengine.com/docs/3.15/guide-faq-why-are-remote-agents-not-updating.html][Why are remote agents not updating?]

[Xander Cage]

masterfiles propagation to clients is working fine. the problem is on the policy server only, the copy from masterfiles to inputs is sowmewhat borked. worked fine before mpf update (3.12.5 -> 3.15.3). i updated from source tar archive, might be there is a bug in this archive.

[Xander Cage]

i installed the server on another machine for testing, everything is working as expected there, same binaries, same masterfiles. inputs directory is populated correctly,  all acl's are correcty set.  completely puzzled.

[Nick Anderson]

Is it possible that you have some stale file handle?

I seem to recall some case where I was mucking around inside /var/cfengine/masterfiles and the directory got removed out from under me, then some things weren't being propagated as I expected and it was related to me being inside a dir that no longer existed.

[Xander Cage]

after downgrade the mpf to 3.12.2 the problems are gone...this is far beyond my ability to comprehend...plain insanity.

[Nick Anderson]

Strange.

Do you have the verbose output from an update.cf policy run on the hub?

cf-agent -Kvf update.cf

--
You received this message because you are subscribed to a topic in the Google Groups "help-cfengine" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/help-cfengine/m7w-snaDV24/unsubscribe.
To unsubscribe from this group and all its topics, send an email to help-cfengin...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/b0cf7771-063b-42b2-bbb9-fbd8551f25ffn%40googlegroups.com.

[Xander Cage]

ok, i think ifound out whats going on. i did what i always do when upgrading the mpf, downloading the mpf source tgz, configure and install it to a temporary prefix, and copy the files over to the actual masterfiles directory. this is how i do this for years.

for some reason,  this temporary install prefix, not the actual masterfiles directory is used when running the update bundles. this only happens when this temporary directory still exists on the server.

nimvie: /var/cfengine/masterfiles # /var/cfengine/bin/cf-agent -Kvf update.cf | grep inputs | grep tremch
 verbose: File '/var/cfengine/inputs' copy_from '/home/tremch/cfe_master_3.15.3/masterfiles'
 verbose: file_select result 'leaf_name' on '/home/tremch/cfe_master_3.15.3/masterfiles/controls/def_inputs.cf' was 'true'
 verbose: file_select result 'leaf_name' on '/home/tremch/cfe_master_3.15.3/masterfiles/controls/update_def_inputs.cf' was 'true'
 verbose: Copy of regular file succeeded '/home/tremch/cfe_master_3.15.3/masterfiles/templates/federated_reporting/dump.sh' to '/var/cfengine/inputs/templates/federated_reporting/dump.sh.cfnew'
 verbose: Copy of regular file succeeded '/home/tremch/cfe_master_3.15.3/masterfiles/templates/federated_reporting/import.sh' to '/var/cfengine/inputs/templates/federated_reporting/import.sh.cfnew'
 verbose: Copy of regular file succeeded '/home/tremch/cfe_master_3.15.3/masterfiles/templates/federated_reporting/import_file.sh' to '/var/cfengine/inputs/templates/federated_reporting/import_file.sh.cfnew'
 verbose: Copy of regular file succeeded '/home/tremch/cfe_master_3.15.3/masterfiles/templates/federated_reporting/parallel.sh' to '/var/cfengine/inputs/templates/federated_reporting/parallel.sh.cfnew'
 verbose: Copy of regular file succeeded '/home/tremch/cfe_master_3.15.3/masterfiles/templates/federated_reporting/pull_dumps_from.sh' to '/var/cfengine/inputs/templates/federated_reporting/pull_dumps_from.sh.cfnew'
 verbose: Copy of regular file succeeded '/home/tremch/cfe_master_3.15.3/masterfiles/templates/federated_reporting/transport.sh' to '/var/cfengine/inputs/templates/federated_reporting/transport.sh.cfnew'
 verbose: Handling file existence constraints on '/home/tremch/cfe_master_3.15.3/masterfiles/./controls/def_inputs.cf'
 verbose: File permissions on '/home/tremch/cfe_master_3.15.3/masterfiles/./controls/def_inputs.cf' as promised
 verbose: Handling file existence constraints on '/home/tremch/cfe_master_3.15.3/masterfiles/./controls/update_def_inputs.cf'
 verbose: File permissions on '/home/tremch/cfe_master_3.15.3/masterfiles/./controls/update_def_inputs.cf' as promised

after renaming this temporary directory, at least an error is thrown...and the inputs directory gets populated.

 mv /home/tremch/cfe_master_3.15.3 /home/tremch/cfe_master_3.15.3_bla

nimvie: /var/cfengine/masterfiles # /var/cfengine/bin/startup.sh start
  notice: Q: ".../cf-agent" -f /":    error: Method 'cfe_internal_update_policy_cpv' failed in some repairs
R: Bootstrapping from host '172.17.8.4' via built-in policy '/var/cfengine/inputs/failsafe.cf'
R: This host assumes the role of policy server
R: Updated local policy from policy server
  notice: Bootstrap to '172.17.8.4' completed successfully!

i am not shure what this als means...has somehing changed in the mpf install procedure?

[Xander Cage]

this is the bad boy i guess ->

nimvie: /var/cfengine/masterfiles # grep -r tremch *
controls/update_def.cf:        string => ifelse( "am_policy_hub", "/home/tremch/cfe_master_3.15.3/masterfiles"

[Xander Cage]

# Hubs get the explicit path because they perform local copies (especially
      # during bootstrap) when cf-serverd may not be available. Else we use the
      # "masterfiles" shortcut.

      "mpf_update_policy_master_location" -> { "ENT-3692" }
        string => ifelse( "am_policy_hub", "/home/tremch/cfe_master_3.15.3/masterfiles",
                          "masterfiles");

      # Here we allow the masterfiles location to be overridden via augments. If
      # augments overides the value, use that. Note: Since hubs do not perform
      # copies to themselves over cf-serverd, this should be a fully qualified
      # path or special considerations must be made for hub bootstrapping.

      "mpf_update_policy_master_location" -> { "ENT-3692" }
        comment => "Directory where clients should get policy from.",
        string => "$(def.mpf_update_policy_master_location)",
        if => isvariable( "def.mpf_update_policy_master_location" );

[Xander Cage]

i added this to augmens vars...this helped...is this correct?

"mpf_update_policy_master_location": "masterfiles",

[Xander Cage]

this error is still in the outputs....

nimvie: /var/cfengine/outputs # cat cf_nimvie__1615450909_Thu_Mar_11_09_21_49_2021_10b

   error: Method 'cfe_internal_update_policy_cpv' failed in some repairs

[Nick Anderson]

Xander Cage <christia...@itsv.at> writes:

i added this to augmens vars…this helped…is this correct?

"mpf_update_policy_master_location": "masterfiles",

Doing that will set masterfiles as the source location for policy update.

So, it's going to rely on cf-serverd to resolve this as a shortcut (which is something cf-serverd knows how to do).

grep -C4 'shortcut => "masterfiles"' controls/cf_serverd.cf

any::

  "$(def.dir_masterfiles)/"
  handle => "server_access_grant_access_policy",
  shortcut => "masterfiles",
  comment => "Grant access to the policy updates",
  if => isdir( "$(def.dir_masterfiles)/" ),
  admit => { @(def.acl) };

this error is still in the outputs….

nimvie: /var/cfengine/outputs # cat cf_nimvie__1615450909_Thu_Mar_11_09_21_49_2021_10b error: Method 'cfe_internal_update_policy_cpv' failed in some repairs

Run the update policy with --verbose and see what is failing.

Listing 1: Verbose policy run of update.cf

cf-agent -Kvf update.cf

[Xander Cage]

see an excerpt from my local git repo used for mpf update change tracking. between 3.12.5  and 3.15.3 the contents of " mpf_update_policy_master_location" changed from "/var/cfengine/masterfiles" to something not very clever, which was the root of

my problems.  as i always install the mpf source into a temporary prefix before rollout, whats the sense of adding this prefix to the files,and how can i avoid this problems in the future?

diff --git a/controls/update_def.cf b/controls/update_def.cf

index 2270d98..1eca86d 100644 (file)

...
   vars:
-      "current_version" string => "3.12.5";
+      "current_version" string => "3.15.3";
 
   
@@ -134,7 +131,7 @@ bundle common update_def

       # "masterfiles" shortcut.
 
       "mpf_update_policy_master_location" -> { "ENT-3692" }

-        string => ifelse( "am_policy_hub", "/var/cfengine/masterfiles",
+        string => ifelse( "am_policy_hub", "/home/tremch/cfe_master_3.15.3/masterfiles",
                           "masterfiles");
 

       # Here we allow the masterfiles location to be overridden via augments. If

[Nick Anderson]

Xander Cage <christia...@itsv.at> writes:

whats the sense of adding this prefix to the files

Not everyone uses /var/cfengine/masterfiles as the default policy distribution point. This change adding --prefix allows masterfiles to be more easily installed in locations other than /var/cfengine/masterfiles.

how can i avoid this problems in the future?

I think the easiest way would be to use the "ready to install" masterfiles tarball instead of directly from source.

Listing 1: What is the URL for 3.15.3 MPF tarball?

cf-remote --version 3.15.3 list | grep -P ".*masterfiles.*pkg.tar.gz"

https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-3.15.3/misc/cfengine-masterfiles-3.15.3-1.pkg.tar.gz

Or you could build from source using the prefix you intend, installing into a different path with DESTDIR.

Listing 2: Configure with defaults, install to custom path

./autogen.sh
./configure
make DESTDIR="/tmp/MPF-Upgrade" install 

./autogen.sh: Running determine-version.sh ...
./autogen.sh: Running autoreconf ...
/home/nickanderson/CFEngine/masterfiles
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether UID '1000' is supported by ustar format... yes
checking whether GID '1000' is supported by ustar format... yes
checking how to create a ustar tar archive... gnutar
checking if GNU tar supports --hard-dereference... yes
checking whether to enable maintainer-specific portions of Makefiles... yes
checking whether make supports nested variables... (cached) yes
checking for pkg_install... no
checking for shunit2... no

Summary:
Version              -> 3.15.3
Core directory       -> /home/nickanderson/CFEngine/masterfiles/../core
Enterprise directory -> /home/nickanderson/CFEngine/masterfiles/../enterprise
Install prefix       -> /var/cfengine
bindir               -> /var/cfengine/bin

configure: generating makefile targets
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating controls/update_def.cf
config.status: creating modules/packages/Makefile
config.status: creating modules/packages/apt_get
config.status: creating modules/packages/yum
config.status: creating modules/packages/zypper
config.status: creating promises.cf
config.status: creating standalone_self_upgrade.cf
config.status: creating tests/Makefile
config.status: creating tests/acceptance/Makefile
config.status: creating tests/unit/Makefile

DONE: Configuration done. Run "make install" to install CFEngine Masterfiles.

checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking target system type... x86_64-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether UID '1000' is supported by ustar format... yes
checking whether GID '1000' is supported by ustar format... yes
checking how to create a ustar tar archive... gnutar
checking if GNU tar supports --hard-dereference... yes
checking whether to enable maintainer-specific portions of Makefiles... yes
checking whether make supports nested variables... (cached) yes
checking for pkg_install... no
checking for shunit2... no

Summary:
Version              -> 3.15.3
Core directory       -> /home/nickanderson/CFEngine/masterfiles/../core
Enterprise directory -> /home/nickanderson/CFEngine/masterfiles/../enterprise
Install prefix       -> /var/cfengine
bindir               -> /var/cfengine/bin

configure: generating makefile targets
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating Makefile
config.status: creating controls/update_def.cf
config.status: creating modules/packages/Makefile
config.status: creating modules/packages/apt_get
config.status: creating modules/packages/yum
config.status: creating modules/packages/zypper
config.status: creating promises.cf
config.status: creating standalone_self_upgrade.cf
config.status: creating tests/Makefile
config.status: creating tests/acceptance/Makefile
config.status: creating tests/unit/Makefile

DONE: Configuration done. Run "make install" to install CFEngine Masterfiles.

Making install in modules/packages
make[1]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/modules/packages'
make[2]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/modules/packages'
make[2]: Nothing to be done for 'install-exec-am'.
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/modules/packages'
 /usr/bin/install -c apt_get yum pkg nimclient pkgsrc freebsd_ports zypper slackpkg msiexec.bat WiRunSQL.vbs '/tmp/MPF-Upgrade/var/cfengine/modules/packages'
make[2]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/modules/packages'
make[1]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/modules/packages'
Making install in tests/
make[1]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests'
Making install in .
make[2]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests'
make[3]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests'
make[3]: Nothing to be done for 'install-exec-am'.
make[3]: Nothing to be done for 'install-data-am'.
make[3]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests'
make[2]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests'
Making install in unit
make[2]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/unit'
make[3]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/unit'
make[3]: Nothing to be done for 'install-exec-am'.
make[3]: Nothing to be done for 'install-data-am'.
make[3]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/unit'
make[2]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/unit'
Making install in acceptance
make[2]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/acceptance'
make[3]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/acceptance'
make[3]: Nothing to be done for 'install-exec-am'.
make[3]: Nothing to be done for 'install-data-am'.
make[3]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/acceptance'
make[2]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests/acceptance'
make[1]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles/tests'
make[1]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles'
make[2]: Entering directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles'
make[2]: Nothing to be done for 'install-exec-am'.
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core'
 /usr/bin/install -c -m 644  ./cfe_internal/core/main.cf ./cfe_internal/core/limit_robot_agents.cf ./cfe_internal/core/host_info_report.cf ./cfe_internal/core/log_rotation.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise/templates'
 /usr/bin/install -c -m 644  ./cfe_internal/enterprise/templates/runalerts.sh.mustache ./cfe_internal/enterprise/templates/runalerts.php.mustache ./cfe_internal/enterprise/templates/httpd.conf.mustache '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise/templates'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/inventory'
 /usr/bin/install -c -m 644  ./inventory/debian.cf ./inventory/os.cf ./inventory/aix.cf ./inventory/lsb.cf ./inventory/freebsd.cf ./inventory/generic.cf ./inventory/linux.cf ./inventory/any.cf ./inventory/suse.cf ./inventory/redhat.cf ./inventory/windows.cf ./inventory/macos.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/inventory'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise/federation'
 /usr/bin/install -c -m 644  ./cfe_internal/enterprise/federation/federation.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise/federation'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core/deprecated'
 /usr/bin/install -c -m 644  ./cfe_internal/core/deprecated/cfengine_processes.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core/deprecated'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/services/autorun'
 /usr/bin/install -c -m 644  ./services/autorun/hello.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/services/autorun'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/lib'
 /usr/bin/install -c -m 644  ./lib/stdlib.cf ./lib/storage.cf ./lib/monitor.cf ./lib/bundles.cf ./lib/cfe_internal_hub.cf ./lib/processes.cf ./lib/files.cf ./lib/users.cf ./lib/cfengine_enterprise_hub_ha.cf ./lib/autorun.cf ./lib/databases.cf ./lib/packages-ENT-3719.cf ./lib/cfe_internal.cf ./lib/paths.cf ./lib/services.cf ./lib/event.cf ./lib/common.cf ./lib/commands.cf ./lib/feature.cf ./lib/reports.cf ./lib/guest_environments.cf ./lib/packages.cf ./lib/examples.cf ./lib/vcs.cf ./lib/edit_xml.cf ./lib/testing.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/lib'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/update'
 /usr/bin/install -c -m 644  ./cfe_internal/update/lib.cf ./cfe_internal/update/update_bins.cf ./cfe_internal/update/cfe_internal_dc_workflow.cf ./cfe_internal/update/update_policy.cf ./cfe_internal/update/cfe_internal_update_from_repository.cf ./cfe_internal/update/systemd_units.cf ./cfe_internal/update/update_processes.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/update'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/controls'
 /usr/bin/install -c -m 644  ./controls/def_inputs.cf ./controls/cf_serverd.cf ./controls/cf_monitord.cf ./controls/cf_runagent.cf ./controls/cf_hub.cf ./controls/update_def_inputs.cf ./controls/cf_execd.cf ./controls/def.cf ./controls/cf_agent.cf ./controls/reports.cf ./controls/update_def.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/controls'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise/ha'
 /usr/bin/install -c -m 644  ./cfe_internal/enterprise/ha/ha_update.cf ./cfe_internal/enterprise/ha/ha_def.cf ./cfe_internal/enterprise/ha/ha.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise/ha'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal'
 /usr/bin/install -c -m 644  ./cfe_internal/recommendations.cf ./cfe_internal/CFE_cfengine.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal'
 /usr/bin/install -c -m 644  ./update.cf ./promises.cf ./standalone_self_upgrade.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/.'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core/watchdog'
 /usr/bin/install -c -m 644  ./cfe_internal/core/watchdog/watchdog.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core/watchdog'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core/watchdog/templates'
 /usr/bin/install -c -m 644  ./cfe_internal/core/watchdog/templates/watchdog-windows.ps1.mustache ./cfe_internal/core/watchdog/templates/watchdog.mustache '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/core/watchdog/templates'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/templates'
 /usr/bin/install -c -m 644  ./templates/cfengine3.service.mustache ./templates/cf-serverd.service.mustache ./templates/cf-runalerts.service.mustache ./templates/json_serial.mustache ./templates/cf-hub.service.mustache ./templates/cf-monitord.service.mustache ./templates/cfengine_watchdog.mustache ./templates/cf-apache.service.mustache ./templates/cf-postgres.service.mustache ./templates/host_info_report.mustache ./templates/cf-execd.service.mustache ./templates/json_multiline.mustache '/tmp/MPF-Upgrade/var/cfengine/masterfiles/templates'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise'
 /usr/bin/install -c -m 644  ./cfe_internal/enterprise/main.cf ./cfe_internal/enterprise/CFE_hub_specific.cf ./cfe_internal/enterprise/file_change.cf ./cfe_internal/enterprise/CFE_knowledge.cf ./cfe_internal/enterprise/mission_portal.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/cfe_internal/enterprise'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/templates/federated_reporting'
 /usr/bin/install -c -m 644  ./templates/federated_reporting/log.sh.mustache ./templates/federated_reporting/parallel.sh ./templates/federated_reporting/50-merge_inserts.awk ./templates/federated_reporting/import_file.sh ./templates/federated_reporting/pull_dumps_from.sh ./templates/federated_reporting/10-base_filter.sed ./templates/federated_reporting/import.sh ./templates/federated_reporting/dump.sh ./templates/federated_reporting/transport.sh ./templates/federated_reporting/config.sh.mustache ./templates/federated_reporting/psql_wrapper.sh.mustache '/tmp/MPF-Upgrade/var/cfengine/masterfiles/templates/federated_reporting'
 /bin/mkdir -p '/tmp/MPF-Upgrade/var/cfengine/masterfiles/services'
 /usr/bin/install -c -m 644  ./services/main.cf '/tmp/MPF-Upgrade/var/cfengine/masterfiles/services'
make[2]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles'
make[1]: Leaving directory '/home/nickanderson/Northern.Tech/CFEngine/masterfiles'