diff --git a/salt/common/init.sls b/salt/common/init.sls index bafd12fd6..34b84f09d 100644 --- a/salt/common/init.sls +++ b/salt/common/init.sls @@ -117,14 +117,25 @@ elastic_curl_config: {% endif %} +# A non-root owner here can chmod the directory and replace any script in it, including +# the root-owned ones. 555 is the mode the filesystem RPM ships; root ignores it anyway. +usr_sbin_perms: + file.directory: + - name: /usr/sbin + - user: root + - group: root + - mode: 555 + common_sbin: file.recurse: - name: /usr/sbin - source: salt://common/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - show_changes: False + - require: + - file: usr_sbin_perms {% if GLOBALS.role == 'so-heavynode' %} - exclude_pat: - so-pcap-import @@ -159,8 +170,8 @@ common_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://common/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - show_changes: False @@ -173,6 +184,8 @@ so-status_script: file.managed: - name: /usr/sbin/so-status - source: salt://common/tools/sbin/so-status + - user: root + - group: root - mode: 755 {% if GLOBALS.is_sensor %} diff --git a/salt/common/soup_scripts.sls b/salt/common/soup_scripts.sls index 6b2f1551d..50be19bb4 100644 --- a/salt/common/soup_scripts.sls +++ b/salt/common/soup_scripts.sls @@ -18,47 +18,61 @@ copy_so-common_common_tools_sbin: - name: /opt/so/saltstack/default/salt/common/tools/sbin/so-common - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-common - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-image-common_common_tools_sbin: file.copy: - name: /opt/so/saltstack/default/salt/common/tools/sbin/so-image-common - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-image-common - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_soup_manager_tools_sbin: file.copy: - name: /opt/so/saltstack/default/salt/manager/tools/sbin/soup - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/soup - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-firewall_manager_tools_sbin: file.copy: - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-firewall - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-firewall - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-yaml_manager_tools_sbin: file.copy: - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-yaml.py - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-yaml.py - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-repo-sync_manager_tools_sbin: file.copy: - name: /opt/so/saltstack/default/salt/manager/tools/sbin/so-repo-sync - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-repo-sync - - preserve: True + - user: root + - group: root + - mode: 755 copy_bootstrap-salt_manager_tools_sbin: file.copy: - name: /opt/so/saltstack/default/salt/salt/scripts/bootstrap-salt.sh - source: {{UPDATE_DIR}}/salt/salt/scripts/bootstrap-salt.sh - - preserve: True + - user: root + - group: root + - mode: 644 # This section is used to put the new script in place so that it can be called during soup. # It is faster than calling the states that normally manage them to put them in place. @@ -67,46 +81,60 @@ copy_so-common_sbin: - name: /usr/sbin/so-common - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-common - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-image-common_sbin: file.copy: - name: /usr/sbin/so-image-common - source: {{UPDATE_DIR}}/salt/common/tools/sbin/so-image-common - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_soup_sbin: file.copy: - name: /usr/sbin/soup - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/soup - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-firewall_sbin: file.copy: - name: /usr/sbin/so-firewall - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-firewall - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-yaml_sbin: file.copy: - name: /usr/sbin/so-yaml.py - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-yaml.py - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_so-repo-sync_sbin: file.copy: - name: /usr/sbin/so-repo-sync - source: {{UPDATE_DIR}}/salt/manager/tools/sbin/so-repo-sync - force: True - - preserve: True + - user: root + - group: root + - mode: 755 copy_bootstrap-salt_sbin: file.copy: - name: /usr/sbin/bootstrap-salt.sh - source: {{UPDATE_DIR}}/salt/salt/scripts/bootstrap-salt.sh - force: True - - preserve: True + - user: root + - group: root + - mode: 755 diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index fbcd37bb9..c8ebae084 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -240,7 +240,8 @@ copy_new_files() { cd $UPDATE_DIR rsync -a salt $DEFAULT_SALT_DIR/ --delete "${EXCLUDE_ARGS[@]}" rsync -a pillar $DEFAULT_SALT_DIR/ --delete "${EXCLUDE_ARGS[@]}" - chown -R socore:socore $DEFAULT_SALT_DIR/ + # Root-executed code; SOC only needs to read it. Local dirs stay socore-owned. + chown -R root:root $DEFAULT_SALT_DIR/ cd /tmp } diff --git a/salt/elastalert/config.sls b/salt/elastalert/config.sls index 25d5bf5f8..147666e6e 100644 --- a/salt/elastalert/config.sls +++ b/salt/elastalert/config.sls @@ -33,8 +33,8 @@ elastalert_sbin: file.recurse: - name: /usr/sbin - source: salt://elastalert/tools/sbin - - user: 933 - - group: 939 + - user: root + - group: root - file_mode: 755 #elastalert_sbin_jinja: diff --git a/salt/elasticagent/config.sls b/salt/elasticagent/config.sls index b54186fab..63992b199 100644 --- a/salt/elasticagent/config.sls +++ b/salt/elasticagent/config.sls @@ -39,8 +39,8 @@ elasticagent_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://elasticagent/tools/sbin_jinja - - user: 949 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja diff --git a/salt/elasticfleet/config.sls b/salt/elasticfleet/config.sls index 6a8919605..59f052b7f 100644 --- a/salt/elasticfleet/config.sls +++ b/salt/elasticfleet/config.sls @@ -31,8 +31,8 @@ elasticfleet_sbin: file.recurse: - name: /usr/sbin - source: salt://elasticfleet/tools/sbin - - user: 947 - - group: 939 + - user: root + - group: root - file_mode: 755 - show_changes: False @@ -40,8 +40,8 @@ elasticfleet_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://elasticfleet/tools/sbin_jinja - - user: 947 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - exclude_pat: @@ -81,8 +81,8 @@ eapackageupgrade: file.managed: - name: /usr/sbin/so-elastic-fleet-package-upgrade - source: salt://elasticfleet/tools/sbin_jinja/so-elastic-fleet-package-upgrade - - user: 947 - - group: 939 + - user: root + - group: root - mode: 755 - template: jinja diff --git a/salt/elasticfleet/install_agent_grid.sls b/salt/elasticfleet/install_agent_grid.sls index 7ed727b48..ca36b06de 100644 --- a/salt/elasticfleet/install_agent_grid.sls +++ b/salt/elasticfleet/install_agent_grid.sls @@ -14,8 +14,8 @@ so-elastic-agent-install: file.managed: - name: /usr/sbin/so-elastic-agent-install - source: salt://elasticfleet/tools/sbin/so-elastic-agent-install - - user: 947 - - group: 939 + - user: root + - group: root - mode: 755 - show_changes: False diff --git a/salt/elasticsearch/config.sls b/salt/elasticsearch/config.sls index cbfdca406..5c1645ca6 100644 --- a/salt/elasticsearch/config.sls +++ b/salt/elasticsearch/config.sls @@ -37,8 +37,8 @@ elasticsearch_sbin: file.recurse: - name: /usr/sbin - source: salt://elasticsearch/tools/sbin - - user: 930 - - group: 939 + - user: root + - group: root - file_mode: 755 - exclude_pat: - so-elasticsearch-pipelines # exclude this because we need to watch it for changes, we sync it in another state @@ -49,8 +49,8 @@ so-elasticsearch-system-indices-patch-script: file.managed: - name: /usr/sbin/so-elasticsearch-system-indices-patch - source: salt://elasticsearch/tools/sbin/so-elasticsearch-system-indices-patch - - user: 930 - - group: 939 + - user: root + - group: root - mode: 755 - show_changes: False @@ -58,8 +58,8 @@ elasticsearch_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://elasticsearch/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - exclude_pat: @@ -72,8 +72,8 @@ so-elasticsearch-ilm-policy-load-script: file.managed: - name: /usr/sbin/so-elasticsearch-ilm-policy-load - source: salt://elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load - - user: 930 - - group: 939 + - user: root + - group: root - mode: 754 - template: jinja - defaults: @@ -84,8 +84,8 @@ so-elasticsearch-pipelines-script: file.managed: - name: /usr/sbin/so-elasticsearch-pipelines - source: salt://elasticsearch/tools/sbin/so-elasticsearch-pipelines - - user: 930 - - group: 939 + - user: root + - group: root - mode: 754 - show_changes: False diff --git a/salt/hypervisor/init.sls b/salt/hypervisor/init.sls index 4a2edad75..106d366b7 100644 --- a/salt/hypervisor/init.sls +++ b/salt/hypervisor/init.sls @@ -21,12 +21,16 @@ hypervisor_sbin: file.recurse: - name: /usr/sbin - source: salt://hypervisor/tools/sbin + - user: root + - group: root - file_mode: 744 hypervisor_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://hypervisor/tools/sbin_jinja + - user: root + - group: root - template: jinja - file_mode: 744 diff --git a/salt/idh/config.sls b/salt/idh/config.sls index 2e6315007..e17823604 100644 --- a/salt/idh/config.sls +++ b/salt/idh/config.sls @@ -86,8 +86,8 @@ idh_sbin: file.recurse: - name: /usr/sbin - source: salt://idh/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #idh_sbin_jinja: diff --git a/salt/influxdb/config.sls b/salt/influxdb/config.sls index bf8b67b78..819d78b98 100644 --- a/salt/influxdb/config.sls +++ b/salt/influxdb/config.sls @@ -41,8 +41,8 @@ influxdb_sbin: file.recurse: - name: /usr/sbin - source: salt://influxdb/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #influxdb_sbin_jinja: diff --git a/salt/kafka/config.sls b/salt/kafka/config.sls index 1bedf96a0..6a7c30c94 100644 --- a/salt/kafka/config.sls +++ b/salt/kafka/config.sls @@ -30,16 +30,16 @@ kafka_sbin_tools: file.recurse: - name: /usr/sbin - source: salt://kafka/tools/sbin - - user: 960 - - group: 960 + - user: root + - group: root - file_mode: 755 kafka_sbin_jinja_tools: file.recurse: - name: /usr/sbin - source: salt://kafka/tools/sbin_jinja - - user: 960 - - group: 960 + - user: root + - group: root - file_mode: 755 - template: jinja - defaults: diff --git a/salt/kibana/config.sls b/salt/kibana/config.sls index 433fc9601..bc4e5f431 100644 --- a/salt/kibana/config.sls +++ b/salt/kibana/config.sls @@ -36,16 +36,16 @@ kibana_sbin: file.recurse: - name: /usr/sbin - source: salt://kibana/tools/sbin - - user: 932 - - group: 939 + - user: root + - group: root - file_mode: 755 kibana_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://kibana/tools/sbin_jinja - - user: 932 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja - defaults: diff --git a/salt/libvirt/64962/init.sls b/salt/libvirt/64962/init.sls index e20f24f2d..973da0e97 100644 --- a/salt/libvirt/64962/init.sls +++ b/salt/libvirt/64962/init.sls @@ -6,6 +6,8 @@ so-fix-salt-ldap_script: file.managed: - name: /usr/sbin/so-fix-salt-ldap.py - source: salt://libvirt/64962/scripts/so-fix-salt-ldap.py + - user: root + - group: root - mode: 744 fix-salt-ldap: diff --git a/salt/logstash/config.sls b/salt/logstash/config.sls index 80fbe44b2..7a09349fc 100644 --- a/salt/logstash/config.sls +++ b/salt/logstash/config.sls @@ -40,8 +40,8 @@ logstash_sbin: file.recurse: - name: /usr/sbin - source: salt://logstash/tools/sbin - - user: 931 - - group: 939 + - user: root + - group: root - file_mode: 755 #logstash_sbin_jinja: diff --git a/salt/manager/init.sls b/salt/manager/init.sls index a74d16ff2..87669fad4 100644 --- a/salt/manager/init.sls +++ b/salt/manager/init.sls @@ -113,8 +113,8 @@ manager_sbin: file.recurse: - name: /usr/sbin - source: salt://manager/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - exclude_pat: - "*_test.py" @@ -124,8 +124,8 @@ manager_sbin_jinja: file.recurse: - name: /usr/sbin/ - source: salt://manager/tools/sbin_jinja/ - - user: socore - - group: socore + - user: root + - group: root - file_mode: 755 - template: jinja - show_changes: False @@ -190,11 +190,15 @@ so_fleetagent_monitor: - month: '*' - dayweek: '*' -socore_own_saltstack_default: +# This tree is the source of every root-executed script (/usr/sbin, reactors, _runners, +# engines, salt-relay.sh). SOC mounts /opt/so/saltstack rw as uid 939 but only writes +# under local/. Do not add dir_mode/file_mode here -- SOC reads default/ and 750/640 +# would break its config load. +root_own_saltstack_default: file.directory: - name: /opt/so/saltstack/default - - user: socore - - group: socore + - user: root + - group: root - recurse: - user - group diff --git a/salt/manager/tools/sbin/so-saltstack-update b/salt/manager/tools/sbin/so-saltstack-update index c8723beb0..4ff4b0519 100755 --- a/salt/manager/tools/sbin/so-saltstack-update +++ b/salt/manager/tools/sbin/so-saltstack-update @@ -124,8 +124,8 @@ copy_new_files() { rsync -a salt $default_salt_dir/ rsync -a pillar $default_salt_dir/ - chown -R socore:socore $default_salt_dir/salt - chown -R socore:socore $default_salt_dir/pillar + chown -R root:root $default_salt_dir/salt + chown -R root:root $default_salt_dir/pillar chmod 755 $default_salt_dir/pillar/firewall/addfirewall.sh rm -rf /tmp/sogh diff --git a/salt/nginx/config.sls b/salt/nginx/config.sls index ead3d9986..9b0e72a68 100644 --- a/salt/nginx/config.sls +++ b/salt/nginx/config.sls @@ -57,8 +57,8 @@ nginx_sbin: file.recurse: - name: /usr/sbin - source: salt://nginx/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #nginx_sbin_jinja: diff --git a/salt/redis/config.sls b/salt/redis/config.sls index 11aaa1f0e..13ac7e056 100644 --- a/salt/redis/config.sls +++ b/salt/redis/config.sls @@ -50,16 +50,16 @@ redis_sbin: file.recurse: - name: /usr/sbin - source: salt://redis/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 redis_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://redis/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja diff --git a/salt/salt/init.sls b/salt/salt/init.sls index d39c984eb..64a0a8794 100644 --- a/salt/salt/init.sls +++ b/salt/salt/init.sls @@ -3,6 +3,8 @@ salt_bootstrap: file.managed: - name: /usr/sbin/bootstrap-salt.sh - source: salt://salt/scripts/bootstrap-salt.sh + - user: root + - group: root - mode: 755 - show_changes: False @@ -10,6 +12,6 @@ salt_sbin: file.recurse: - name: /usr/sbin - source: salt://salt/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 diff --git a/salt/sensor/init.sls b/salt/sensor/init.sls index 7d1714c2c..0b302e186 100644 --- a/salt/sensor/init.sls +++ b/salt/sensor/init.sls @@ -35,6 +35,8 @@ combine_bond_script: file.managed: - name: /usr/sbin/so-combine-bond - source: salt://sensor/tools/sbin_jinja/so-combine-bond + - user: root + - group: root - mode: 755 - template: jinja - defaults: diff --git a/salt/sensoroni/config.sls b/salt/sensoroni/config.sls index 225d0ddb4..75c92b971 100644 --- a/salt/sensoroni/config.sls +++ b/salt/sensoroni/config.sls @@ -64,8 +64,8 @@ sensoroni_sbin: file.recurse: - name: /usr/sbin - source: salt://sensoroni/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #sensoroni_sbin_jinja: diff --git a/salt/soc/config.sls b/salt/soc/config.sls index 3609b7024..677c63e5d 100644 --- a/salt/soc/config.sls +++ b/salt/soc/config.sls @@ -171,8 +171,8 @@ soc_sbin: file.recurse: - name: /usr/sbin - source: salt://soc/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #soc_sbin_jinja: diff --git a/salt/soc/dyanno/hypervisor/init.sls b/salt/soc/dyanno/hypervisor/init.sls index 1f17552e7..41b7a2ebf 100644 --- a/salt/soc/dyanno/hypervisor/init.sls +++ b/salt/soc/dyanno/hypervisor/init.sls @@ -18,8 +18,8 @@ hypervisor_annotation: - name: /opt/so/saltstack/default/salt/hypervisor/soc_hypervisor.yaml - source: salt://soc/dyanno/hypervisor/soc_hypervisor.yaml.jinja - template: jinja - - user: socore - - group: socore + - user: root + - group: root - defaults: HYPERVISORS: {{ HYPERVISORS }} baseDomainStatus: {{ salt['pillar.get']('baseDomain:status', 'Initialized') }} diff --git a/salt/strelka/config.sls b/salt/strelka/config.sls index f03afa61b..2c5fe741d 100644 --- a/salt/strelka/config.sls +++ b/salt/strelka/config.sls @@ -51,8 +51,8 @@ strelka_sbin: file.recurse: - name: /usr/sbin - source: salt://strelka/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 {% else %} diff --git a/salt/suricata/config.sls b/salt/suricata/config.sls index da75580e3..dd228ef31 100644 --- a/salt/suricata/config.sls +++ b/salt/suricata/config.sls @@ -76,16 +76,16 @@ suricata_sbin: file.recurse: - name: /usr/sbin - source: salt://suricata/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 suricata_sbin_jinja: file.recurse: - name: /usr/sbin - source: salt://suricata/tools/sbin_jinja - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 - template: jinja diff --git a/salt/telegraf/config.sls b/salt/telegraf/config.sls index 3873d1da0..18ac51ddd 100644 --- a/salt/telegraf/config.sls +++ b/salt/telegraf/config.sls @@ -65,8 +65,8 @@ telegraf_sbin: file.recurse: - name: /usr/sbin - source: salt://telegraf/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #telegraf_sbin_jinja: diff --git a/salt/zeek/config.sls b/salt/zeek/config.sls index 3677b1ba1..17a495010 100644 --- a/salt/zeek/config.sls +++ b/salt/zeek/config.sls @@ -101,8 +101,8 @@ zeek_sbin: file.recurse: - name: /usr/sbin - source: salt://zeek/tools/sbin - - user: 939 - - group: 939 + - user: root + - group: root - file_mode: 755 #zeek_sbin_jinja: diff --git a/setup/so-functions b/setup/so-functions index 1269b4e9d..64e809be5 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -2105,6 +2105,8 @@ setup_salt_master_dirs() { info "Chown the salt dirs on the manager for socore" logCmd "chown -R socore:socore /opt/so" + # The default tree is root-executed code; SOC reads it but never writes it. + logCmd "chown -R root:root $default_salt_dir" } set_progress_str() {