Jira (PUP-11015) The "posix" provider of the "exec" resource does not fullfil the documentation

[Felix (Jira)]

Felix moved an issue

Puppet / PUP-11015 The "posix" provider of the "exec" resource does not fullfil the documentation Change By: Felix Key: CPR PUP - 776 11015 Project: Community Package Repository Puppet Add Comment

This message was sent by Atlassian Jira (v8.13.2#813002-sha1:c495a97)

[Mihai Buzgau (Jira)]

Mihai Buzgau updated an issue

Puppet / PUP-11015 The "posix" provider of the "exec" resource does not fullfil the documentation

Change By: Mihai Buzgau Labels: community

Add Comment

[Josh Cooper (Jira)]

Josh Cooper updated an issue

Puppet / PUP-11015 The "posix" provider of the "exec" resource does not fullfil the documentation

Change By: Josh Cooper The documentation for the posix provider states: > Executes external binaries directly, without passing through a shell or performing any interpolation. This is a safer and more predictable way to execute most commands, but prevents the use of globbing and shell built-ins (including control logic like “for” and “if” statements). This is not the case at all: Consider this resource: {code:puppet} exec{'testexec':    command => '/bin/echo $SHELL',   logoutput => true } {code} or this: {code:puppet} exec{'testexec':    command => '/bin/echo *',   logoutput => true } {code} This logic seems to be triggered deep down in ruby, which, when a single string is passed to "Kernel.exec", runs it only without a shell, if it does not detect a shell special character or special word, see [https://github.com/ruby/ruby/blob/5f69a7f60467fa58c2f998daffab43e118bff36c/process.c#L2676] So from my point of view the only difference between the "posix" and the "shell" provider seems to be, that the "posix" provider tries to validate that the first "word" is an absolute path to an executable. Note that this validation is also a bit "misleading" or just incomplete/wrong. Consider this command: {code:puppet} exec{'testexec':    command => '"/bin/echo"o *',   logoutput => true } {code} This command will pass the validation (as the check will assume the command is "/bin/echo"), however the command is "/bin/echoo", which does not exist. Or inverse, consider this: {code:puppet} exec{'testexec':    command => '"/bin/ech"o *',   logoutput => true } {code} The validation will reject execution, even though the command would perfectly pass through execution if it is let.   So please clarify, what the benefit/differences between the "posix" and "shell" provider are and correct the documentation accordingly. Is there any way to execute the command without a shell (i.e. specify the command as string array)?

Add Comment

[Josh Cooper (Jira)]

Josh Cooper assigned an issue to Josh Cooper

Puppet / PUP-11015 The "posix" provider of the "exec" resource does not fullfil the documentation

Change By: Josh Cooper Assignee: Josh Cooper

Add Comment

[Josh Cooper (Jira)]

Josh Cooper assigned an issue to Unassigned

[Felix (Jira)]

Felix commented on PUP-11015

Re: The "posix" provider of the "exec" resource does not fullfil the documentation Hi, would you care to share any thoughts on this? I'd actually prefer this issue to be handled rather than letting it fall into oblivion, as this might on the one hand be very unexpected to puppet users and on the other hand might actually constitute a security issue for puppet users relying on the documentation when embedding not-completely-trusted values into commands during execution.

Add Comment