Jira (PUP-10100) Exec resource should not leak sensitive commands when a relative path is given

[Josh Cooper (JIRA)]

Josh Cooper created an issue

Puppet / PUP-10100 Exec resource should not leak sensitive commands when a relative path is given Issue Type: Bug Assignee: Unassigned Created: 2019/10/11 9:56 AM Priority: Normal Reporter: Josh Cooper From: https://tickets.puppetlabs.com/browse/PUP-6494?focusedCommentId=692157&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-692157 exec { "echo_passphrase": command => Sensitive("echo \"${secretpw.unwrap}\""), } Error: Failed to apply catalog: Validation of Exec[populate_luksfile] failed: 'echo "supersecretpassword"' is not qualified and no path was specified. Please qualify the command or specify a path. The issue is the error message includes the entire command to execute, instead of the first component of command which wasn't an absolute path. Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10100

Re: Exec resource should not leak sensitive commands when a relative path is given This is a simple fix: $ bx puppet apply -e "exec { 'echo_passphrase': command => Sensitive('echo foo'), }" Notice: Compiled catalog for localhost in environment production in 0.09 seconds Error: Validation of Exec[echo_passphrase] failed: 'echo' is not qualified and no path was specified. Please qualify the command or specify a path. (line: 1) diff --git a/lib/puppet/provider/exec.rb b/lib/puppet/provider/exec.rb index 778099c221..c89c3da5da 100644 --- a/lib/puppet/provider/exec.rb +++ b/lib/puppet/provider/exec.rb @@ -88,6 +88,6 @@ class Puppet::Provider::Exec < Puppet::Provider def validatecmd(command) exe = extractexe(command) # if we're not fully qualified, require a path - self.fail _("'%{command}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { command: command } if !absolute_path?(exe) and resource[:path].nil? + self.fail _("'%{exe}' is not qualified and no path was specified. Please qualify the command or specify a path.") % { exe: exe } if !absolute_path?(exe) and resource[:path].nil? end end Note the extractexe command knows how to extract quoted executables, as often occur on Windows.

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-10100

Exec resource should not leak sensitive commands when a relative path is given

Change By: Josh Cooper Sprint: Platform Core KANBAN

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper assigned an issue to Josh Cooper

Puppet / PUP-10100 Exec resource should not leak sensitive commands when a relative path is given

Change By: Josh Cooper Assignee: Josh Cooper

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10100

Re: Exec resource should not leak sensitive commands when a relative path is given Brian Conner, Kledson Basso, Adam Winberg since you commented on PUP-6494, what do you think about the above approach to redact sensitive commands? For example, given exec { "echo_passphrase": command => Sensitive("echo \"${secretpw.unwrap}\""), } will fail since echo is not fully qualified. Is it ok for the error message to specify only the executable in the error message? Or would you expect the entire command is redacted? Trying to balance security with user experience when debugging failed exec resources.

Add Comment

[Adam Winberg (JIRA)]

Adam Winberg commented on PUP-10100

Re: Exec resource should not leak sensitive commands when a relative path is given

Is it ok for the error message to specify only the executable in the error message? Yes, that would be fine for me.

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-10100

Exec resource should not leak sensitive commands when a relative path is given

Change By: Josh Cooper Fix Version/s: PUP 6.11.0 Fix Version/s: PUP 6.4.5 Fix Version/s: PUP 5.5.18

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-10100 Exec resource should not leak sensitive commands when a relative path is given

Change By: Josh Cooper Release Notes Summary: Redact arguments passed to exec command, onlyif or unless parameters. Release Notes: Bug Fix

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-10100 Exec resource should not leak sensitive commands when a relative path is given

Change By: Josh Cooper Release Notes Summary: Redact If an exec resource's command is not executable or cannot be resolved into a fully qualified path, only print the command, but not the potentially sensitive arguments passed to exec the command . Also redact the output of sensitive commands when the logoutput parameter is true , onlyif or unless parameters the parameter is on_failure (the default) and the command fails .

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10100

Re: Exec resource should not leak sensitive commands when a relative path is given Merged to 5.5.x in https://github.com/puppetlabs/puppet/commit/c944d03feda9c9698de735772eccbae3f51bbd9c

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10100

Re: Exec resource should not leak sensitive commands when a relative path is given

Passed CI in 5a7e3ec4bf

Add Comment

[Heston Hoffman (JIRA)]

Heston Hoffman updated an issue

Puppet / PUP-10100

Exec resource should not leak sensitive commands when a relative path is given

Change By: Heston Hoffman Labels: resolved-issue-added

Add Comment