[BUG] dmidecode/smbios/virt-what should be called with sudo
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
As mentioned as a solution in #6746 (https://github.com/saltstack/salt/issues/6746#issuecomment-22801339) but seemingly ignored, dmidecode/smbios in salt/modules/smbios.py and dmidecode/virt-what in salt/grains/core.py should be invoked with sudo (if present on the system) by default.
(Note: in the following cases, I'll refer to dmidecode explicitly but the same holds for all three utilites in theory.)
For my use case, I run a master as a non-root user. As a result, e.g. dmidecode cannot be invoked (and with good reason, normally).
One can SUID dmidecode, but this (as is most times when making a binary SUID root) results in a flaw where data can be harvested from e.g. /etc/shadow by any user on the system (e.g. dmidecode -d /etc/shadow, for starters). Hardly a good idea.
As such, the only alternative is to invoke dmidecode with sudo. With the following line in a sudoers file:
<salt user> ALL = NOPASSWD:/usr/sbin/dmidecode <dmidecode args salt calls>
Salt master can be run as a normal/system user, with no affect to its running as root (sudo, to my knowledge, on every installation includes root ALL=(ALL) SETENV: ALL in the default configuration) and still have access to dmidecode.
Suggested Resolution
- Have salt call the above tools (
dmidecode,smbios,virt-what), which all require root privileges, with sudo (if sudo is found present on the system).
** As such, they will need to be invoked with the absolute path to match the sudo rule and to prevent another hole. - Document exact commands and arguments that Salt invokes for these programs in particular so a properly restricted sudoers entry can be created (and/or provide an example snippet of the entry).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in salt/modules/smbios.py and salt/grains/core.py, tracing how dmidecode, smbios, and virt-what are located and invoked. Check the existing command arguments and privilege-handling paths first. Done means the requested utilities use absolute paths and sudo when available, with their exact commands and arguments documented for a restricted sudoers entry.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- infrastructure, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100