Jira (BOLT-1329) Delete task wrapper script before running the task

Nick Lewis (JIRA)

unread,

May 21, 2019, 3:09:03 PM5/21/19

to puppe...@googlegroups.com

Nick Lewis created an issue

Puppet Task Runner /

BOLT-1329

Delete task wrapper script before running the task

Issue Type:	Improvement
Assignee:	Unassigned
Created:	2019/05/21 12:08 PM
Priority:	Normal
Reporter:	Nick Lewis

When running a task over SSH with run-as and using the stdin input method, we write a wrapper script to the target that passes the stdin via a heredoc. That means that if the task invocation has sensitive parameters, they are persisted on disk (albeit in a secured temporary file) for the duration of the task run and only cleaned up after it's finished.

We should instead make the script self-deleting by making its first line a call to rm /path/to/the/wrapper/script. Since the script will already have been loaded by the shell, we can safely delete it and continue executing. That will significantly reduce the amount of time that parameters exist on disk, as it will only be between the time we write the script and the time we run the script.