From 1e86be11b23ee2a520bfa5c127eb0e960bd7e0a3 Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Wed, 16 Sep 2026 10:34:20 -0400 Subject: [PATCH] FIX: install /usr/sbin management scripts as root Salt installed the so-* scripts into /usr/sbin owned by unprivileged service UIDs (939/socore, plus 930-960 per service) at mode 755, while root executes those same files from cron, systemd and state cmd.run. Any file-write primitive as one of those UIDs was therefore root. Two mechanisms behind this are not visible in the diff: file.recurse also manages the destination directory, so /usr/sbin itself was chowned to whichever service UID ran last. A directory's owner may always chmod it, so that UID could replace even the scripts already declared user: root -- so-config-backup, so-suricata-eve-clean, so-nsm-mount-nvme. usr_sbin_perms now pins the directory to root:root 555, the mode the filesystem RPM ships. Omitting user:/group: is a no-op on files that already exist, because check_perms only chowns when a user is named. Explicit user: root is what lets upgraded grids self-heal on the next highstate, and what makes a revert chown back rather than silently do nothing. --- salt/common/init.sls | 21 +++++++++++++++++---- salt/elastalert/config.sls | 4 ++-- salt/elasticagent/config.sls | 4 ++-- salt/elasticfleet/config.sls | 12 ++++++------ salt/elasticfleet/install_agent_grid.sls | 4 ++-- salt/elasticsearch/config.sls | 20 ++++++++++---------- salt/hypervisor/init.sls | 4 ++++ salt/idh/config.sls | 4 ++-- salt/influxdb/config.sls | 4 ++-- salt/kafka/config.sls | 8 ++++---- salt/kibana/config.sls | 8 ++++---- salt/libvirt/64962/init.sls | 2 ++ salt/logstash/config.sls | 4 ++-- salt/manager/init.sls | 8 ++++---- salt/nginx/config.sls | 4 ++-- salt/redis/config.sls | 8 ++++---- salt/salt/init.sls | 6 ++++-- salt/sensor/init.sls | 2 ++ salt/sensoroni/config.sls | 4 ++-- salt/soc/config.sls | 4 ++-- salt/strelka/config.sls | 4 ++-- salt/suricata/config.sls | 8 ++++---- salt/telegraf/config.sls | 4 ++-- salt/zeek/config.sls | 4 ++-- 24 files changed, 89 insertions(+), 66 deletions(-) diff --git a/salt/common/init.sls b/salt/common/init.sls index bafd12fd6..34b84f09d 100644 --- a/salt/common/init.sls +++ b/salt/common/init.sls @@ -117,14 +117,25 @@ elastic_curl_config: {% endif %} +# A non-root owner here can chmod the directory and replace any script in it, including +# the root-owned ones. 555 is the mode the filesystem RPM ships; root ignores it anyway. +usr_sbin_perms: + file.directory: + - name: /usr/sbin + - user: root + - group: root + - mode: 555 + common_sbin: file.recurse: - name: /usr/sbin - source: salt://common/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - show_changes: False + - require: + - file: usr_sbin_perms {% if GLOBALS.role == 'so-heavynode' %} - exclude_pat: - so-pcap-import @@ -159,8 +170,8 @@ common_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://common/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - show_changes: False @@ -173,6 +184,8 @@ so-status_script: file.managed: - name: /usr/sbin/so-status - source: salt://common/tools/sbin/so-status + - user: root + - group: root - mode: 755 {% if GLOBALS.is_sensor %} diff --git a/salt/elastalert/config.sls b/salt/elastalert/config.sls index 25d5bf5f8..147666e6e 100644 --- a/salt/elastalert/config.sls +++ b/salt/elastalert/config.sls @@ -33,8 +33,8 @@ elastalert_sbin: file.recurse: - name: /usr/sbin - source: salt://elastalert/tools/sbin - - user: 933 - - group: 939 + - user: root + - group: root - file_mode: 755 #elastalert_sbin_jinja: diff --git a/salt/elasticagent/config.sls b/salt/elasticagent/config.sls index b54186fab..63992b199 100644 --- a/salt/elasticagent/config.sls +++ b/salt/elasticagent/config.sls @@ -39,8 +39,8 @@ elasticagent_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://elasticagent/tools/sbin_jinja - - user: 949 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja diff --git a/salt/elasticfleet/config.sls b/salt/elasticfleet/config.sls index 6a8919605..59f052b7f 100644 --- a/salt/elasticfleet/config.sls +++ b/salt/elasticfleet/config.sls @@ -31,8 +31,8 @@ elasticfleet_sbin: file.recurse: - name: /usr/sbin - source: salt://elasticfleet/tools/sbin - - user: 947 - - group: 939 + - user: root + - group: root - file_mode: 755 - show_changes: False @@ -40,8 +40,8 @@ elasticfleet_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://elasticfleet/tools/sbin_jinja - - user: 947 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - exclude_pat: @@ -81,8 +81,8 @@ eapackageupgrade: file.managed: - name: /usr/sbin/so-elastic-fleet-package-upgrade - source: salt://elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade - - user: 947 - - group: 939 + - user: root + - group: root - mode: 755 - template: jinja diff --git a/salt/elasticfleet/install_agent_grid.sls b/salt/elasticfleet/install_agent_grid.sls index 7ed727b48..ca36b06de 100644 --- a/salt/elasticfleet/install_agent_grid.sls +++ b/salt/elasticfleet/install_agent_grid.sls @@ -14,8 +14,8 @@ so-elastic-agent-install: file.managed: - name: /usr/sbin/so-elastic-agent-install - source: salt://elasticfleet/tools/sbin/so-elastic-agent-install - - user: 947 - - group: 939 + - user: root + - group: root - mode: 755 - show_changes: False diff --git a/salt/elasticsearch/config.sls b/salt/elasticsearch/config.sls index cbfdca406..5c1645ca6 100644 --- a/salt/elasticsearch/config.sls +++ b/salt/elasticsearch/config.sls @@ -37,8 +37,8 @@ elasticsearch_sbin: file.recurse: - name: /usr/sbin - source: salt://elasticsearch/tools/sbin - - user: 930 - - group: 939 + - user: root + - group: root - file_mode: 755 - exclude_pat: - so-elasticsearch-pipelines # exclude this because we need to watch it for changes, we sync it in another state @@ -49,8 +49,8 @@ so-elasticsearch-system-indices-patch-script: file.managed: - name: /usr/sbin/so-elasticsearch-system-indices-patch - source: salt://elasticsearch/tools/sbin/so-elasticsearch-system-indices-patch - - user: 930 - - group: 939 + - user: root + - group: root - mode: 755 - show_changes: False @@ -58,8 +58,8 @@ elasticsearch_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://elasticsearch/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - exclude_pat: @@ -72,8 +72,8 @@ so-elasticsearch-ilm-policy-load-script: file.managed: - name: /usr/sbin/so-elasticsearch-ilm-policy-load - source: salt://elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load - - user: 930 - - group: 939 + - user: root + - group: root - mode: 754 - template: jinja - defaults: @@ -84,8 +84,8 @@ so-elasticsearch-pipelines-script: file.managed: - name: /usr/sbin/so-elasticsearch-pipelines - source: salt://elasticsearch/tools/sbin/so-elasticsearch-pipelines - - user: 930 - - group: 939 + - user: root + - group: root - mode: 754 - show_changes: False diff --git a/salt/hypervisor/init.sls b/salt/hypervisor/init.sls index 4a2edad75..106d366b7 100644 --- a/salt/hypervisor/init.sls +++ b/salt/hypervisor/init.sls @@ -21,12 +21,16 @@ hypervisor_sbin: file.recurse: - name: /usr/sbin - source: salt://hypervisor/tools/sbin + - user: root + - group: root - file_mode: 744 hypervisor_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://hypervisor/tools/sbin_jinja + - user: root + - group: root - template: jinja - file_mode: 744 diff --git a/salt/idh/config.sls b/salt/idh/config.sls index 2e6315007..e17823604 100644 --- a/salt/idh/config.sls +++ b/salt/idh/config.sls @@ -86,8 +86,8 @@ idh_sbin: file.recurse: - name: /usr/sbin - source: salt://idh/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #idh_sbin_jinja: diff --git a/salt/influxdb/config.sls b/salt/influxdb/config.sls index bf8b67b78..819d78b98 100644 --- a/salt/influxdb/config.sls +++ b/salt/influxdb/config.sls @@ -41,8 +41,8 @@ influxdb_sbin: file.recurse: - name: /usr/sbin - source: salt://influxdb/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #influxdb_sbin_jinja: diff --git a/salt/kafka/config.sls b/salt/kafka/config.sls index 1bedf96a0..6a7c30c94 100644 --- a/salt/kafka/config.sls +++ b/salt/kafka/config.sls @@ -30,16 +30,16 @@ kafka_sbin_tools: file.recurse: - name: /usr/sbin - source: salt://kafka/tools/sbin - - user: 960 - - group: 960 + - user: root + - group: root - file_mode: 755 kafka_sbin_jinja_tools: file.recurse: - name: /usr/sbin - source: salt://kafka/tools/sbin_jinja - - user: 960 - - group: 960 + - user: root + - group: root - file_mode: 755 - template: jinja - defaults: diff --git a/salt/kibana/config.sls b/salt/kibana/config.sls index 433fc9601..bc4e5f431 100644 --- a/salt/kibana/config.sls +++ b/salt/kibana/config.sls @@ -36,16 +36,16 @@ kibana_sbin: file.recurse: - name: /usr/sbin - source: salt://kibana/tools/sbin - - user: 932 - - group: 939 + - user: root + - group: root - file_mode: 755 kibana_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://kibana/tools/sbin_jinja - - user: 932 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - defaults: diff --git a/salt/libvirt/64962/init.sls b/salt/libvirt/64962/init.sls index e20f24f2d..973da0e97 100644 --- a/salt/libvirt/64962/init.sls +++ b/salt/libvirt/64962/init.sls @@ -6,6 +6,8 @@ so-fix-salt-ldap_script: file.managed: - name: /usr/sbin/so-fix-salt-ldap.py - source: salt://libvirt/64962/scripts/so-fix-salt-ldap.py + - user: root + - group: root - mode: 744 fix-salt-ldap: diff --git a/salt/logstash/config.sls b/salt/logstash/config.sls index 80fbe44b2..7a09349fc 100644 --- a/salt/logstash/config.sls +++ b/salt/logstash/config.sls @@ -40,8 +40,8 @@ logstash_sbin: file.recurse: - name: /usr/sbin - source: salt://logstash/tools/sbin - - user: 931 - - group: 939 + - user: root + - group: root - file_mode: 755 #logstash_sbin_jinja: diff --git a/salt/manager/init.sls b/salt/manager/init.sls index a74d16ff2..85df680d4 100644 --- a/salt/manager/init.sls +++ b/salt/manager/init.sls @@ -113,8 +113,8 @@ manager_sbin: file.recurse: - name: /usr/sbin - source: salt://manager/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - exclude_pat: - "*_test.py" @@ -124,8 +124,8 @@ manager_sbin_jinja: file.recurse: - name: /usr/sbin/ - source: salt://manager/tools/sbin_jinja/ - - user: socore - - group: socore + - user: root + - group: root - file_mode: 755 - template: jinja - show_changes: False diff --git a/salt/nginx/config.sls b/salt/nginx/config.sls index ead3d9986..9b0e72a68 100644 --- a/salt/nginx/config.sls +++ b/salt/nginx/config.sls @@ -57,8 +57,8 @@ nginx_sbin: file.recurse: - name: /usr/sbin - source: salt://nginx/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #nginx_sbin_jinja: diff --git a/salt/redis/config.sls b/salt/redis/config.sls index 11aaa1f0e..13ac7e056 100644 --- a/salt/redis/config.sls +++ b/salt/redis/config.sls @@ -50,16 +50,16 @@ redis_sbin: file.recurse: - name: /usr/sbin - source: salt://redis/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 redis_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://redis/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja diff --git a/salt/salt/init.sls b/salt/salt/init.sls index d39c984eb..64a0a8794 100644 --- a/salt/salt/init.sls +++ b/salt/salt/init.sls @@ -3,6 +3,8 @@ salt_bootstrap: file.managed: - name: /usr/sbin/bootstrap-salt.sh - source: salt://salt/scripts/bootstrap-salt.sh + - user: root + - group: root - mode: 755 - show_changes: False @@ -10,6 +12,6 @@ salt_sbin: file.recurse: - name: /usr/sbin - source: salt://salt/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 diff --git a/salt/sensor/init.sls b/salt/sensor/init.sls index 7d1714c2c..0b302e186 100644 --- a/salt/sensor/init.sls +++ b/salt/sensor/init.sls @@ -35,6 +35,8 @@ combine_bond_script: file.managed: - name: /usr/sbin/so-combine-bond - source: salt://sensor/tools/sbin_jinja/so-combine-bond + - user: root + - group: root - mode: 755 - template: jinja - defaults: diff --git a/salt/sensoroni/config.sls b/salt/sensoroni/config.sls index 225d0ddb4..75c92b971 100644 --- a/salt/sensoroni/config.sls +++ b/salt/sensoroni/config.sls @@ -64,8 +64,8 @@ sensoroni_sbin: file.recurse: - name: /usr/sbin - source: salt://sensoroni/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #sensoroni_sbin_jinja: diff --git a/salt/soc/config.sls b/salt/soc/config.sls index 3609b7024..677c63e5d 100644 --- a/salt/soc/config.sls +++ b/salt/soc/config.sls @@ -171,8 +171,8 @@ soc_sbin: file.recurse: - name: /usr/sbin - source: salt://soc/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #soc_sbin_jinja: diff --git a/salt/strelka/config.sls b/salt/strelka/config.sls index f03afa61b..2c5fe741d 100644 --- a/salt/strelka/config.sls +++ b/salt/strelka/config.sls @@ -51,8 +51,8 @@ strelka_sbin: file.recurse: - name: /usr/sbin - source: salt://strelka/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 {% else %} diff --git a/salt/suricata/config.sls b/salt/suricata/config.sls index da75580e3..dd228ef31 100644 --- a/salt/suricata/config.sls +++ b/salt/suricata/config.sls @@ -76,16 +76,16 @@ suricata_sbin: file.recurse: - name: /usr/sbin - source: salt://suricata/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 suricata_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://suricata/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja diff --git a/salt/telegraf/config.sls b/salt/telegraf/config.sls index 3873d1da0..18ac51ddd 100644 --- a/salt/telegraf/config.sls +++ b/salt/telegraf/config.sls @@ -65,8 +65,8 @@ telegraf_sbin: file.recurse: - name: /usr/sbin - source: salt://telegraf/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #telegraf_sbin_jinja: diff --git a/salt/zeek/config.sls b/salt/zeek/config.sls index 3677b1ba1..17a495010 100644 --- a/salt/zeek/config.sls +++ b/salt/zeek/config.sls @@ -101,8 +101,8 @@ zeek_sbin: file.recurse: - name: /usr/sbin - source: salt://zeek/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #zeek_sbin_jinja: