saltstack / saltstack/salt

[BUG] dmidecode/smbios/virt-what should be called with sudo

Open
#59,794 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
As mentioned as a solution in #6746 (https://github.com/saltstack/salt/issues/6746#issuecomment-22801339) but seemingly ignored, dmidecode/smbios in salt/modules/smbios.py and dmidecode/virt-what in salt/grains/core.py should be invoked with sudo (if present on the system) by default.

(Note: in the following cases, I'll refer to dmidecode explicitly but the same holds for all three utilites in theory.)

For my use case, I run a master as a non-root user. As a result, e.g. dmidecode cannot be invoked (and with good reason, normally).

One can SUID dmidecode, but this (as is most times when making a binary SUID root) results in a flaw where data can be harvested from e.g. /etc/shadow by any user on the system (e.g. dmidecode -d /etc/shadow, for starters). Hardly a good idea.

As such, the only alternative is to invoke dmidecode with sudo. With the following line in a sudoers file:

<salt user> ALL = NOPASSWD:/usr/sbin/dmidecode <dmidecode args salt calls>

Salt master can be run as a normal/system user, with no affect to its running as root (sudo, to my knowledge, on every installation includes root ALL=(ALL) SETENV: ALL in the default configuration) and still have access to dmidecode.

Suggested Resolution

  • Have salt call the above tools (dmidecode, smbios, virt-what), which all require root privileges, with sudo (if sudo is found present on the system).
    ** As such, they will need to be invoked with the absolute path to match the sudo rule and to prevent another hole.
  • Document exact commands and arguments that Salt invokes for these programs in particular so a properly restricted sudoers entry can be created (and/or provide an example snippet of the entry).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/modules/smbios.py and salt/grains/core.py, tracing how dmidecode, smbios, and virt-what are located and invoked. Check the existing command arguments and privilege-handling paths first. Done means the requested utilities use absolute paths and sudo when available, with their exact commands and arguments documented for a restricted sudoers entry.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.