Josh Patterson
1f1d3ded41
FIX: root-own the Salt default tree so a SOC file-write cannot reach root code
...
/opt/so/saltstack/default holds the source for every root-executed script --
/usr/sbin, the reactors, _runners/_modules/_beacons, the master engines and
salt-relay.sh -- plus every state the root master renders. SOC mounts
/opt/so/saltstack rw as uid 939, so root-owning /usr/sbin alone was not
enough: the next highstate would copy attacker-controlled bytes out of the
tree into the root-owned destination and run them.
SOC never writes under default/, it only reads it. Every SOC write targets
local/, which stays socore-owned, as does /opt/so/state. No mode is enforced
on default/ -- SOC reads that tree, and 750/640 would break its config load.
Also stops copy_new_files(), so-saltstack-update and setup from chowning the
tree back to socore, and replaces preserve: True in soup_scripts.sls, which
carried uid/gid in from the /tmp staging tree and would have undone the
ownership before the first post-soup highstate.
2026-09-16 10:34:21 -04:00
Josh Patterson
94f454c311
cleanup file.absent
2026-03-16 15:57:15 -04:00
Jason Ertel
2c4d833a5b
update 2.4 references to 3
2026-03-05 11:05:19 -05:00
Josh Patterson
028297cef8
add bootstrap-salt to preloaded soup_scripts
2025-03-20 13:46:30 -04:00
m0duspwnens
33fdc23965
remove salt repo files created by saltbootstrap
2024-11-12 11:31:42 -05:00
m0duspwnens
9e5d0e88de
fix soversion path
2024-11-11 15:56:01 -05:00
m0duspwnens
69245e4fad
have soup_scripts remove old salt repo file
2024-11-11 15:31:57 -05:00
Mike Reeves
6a9d78fa7c
Make soup use reposync from the repo
2024-06-21 15:10:44 -04:00
m0duspwnens
427b1e4524
revert soup_scripts back to common
2024-05-15 10:28:02 -04:00
m0duspwnens
2dbbe8dec4
soup_scripts put so-yaml in salt file system. move soup scripts to manager.soup_scripts
2024-05-15 10:07:06 -04:00
Mike Reeves
784ec54795
2.3 updates
2024-04-04 09:24:17 -04:00
Mike Reeves
54fce4bf8f
2.3 updates
2024-04-04 09:21:16 -04:00
Mike Reeves
c4ebe25bab
Attempt to fix 2.3 when main repo changes
2024-04-04 09:18:37 -04:00
Mike Reeves
7668fa1396
Attempt to fix 2.3 when main repo changes
2024-04-04 09:03:29 -04:00
Mike Reeves
470b0e4bf6
Attempt to fix 2.3 when main repo changes
2024-04-04 08:55:13 -04:00
Mike Reeves
d3f163bf9e
Attempt to fix 2.3 when main repo changes
2024-04-04 08:54:04 -04:00
Mike Reeves
4b31632dfc
Attempt to fix 2.3 when main repo changes
2024-04-04 08:52:37 -04:00
Mike Reeves
14c824143b
Attempt to fix 2.3 when main repo changes
2024-04-04 08:48:44 -04:00
Jason Ertel
c1b5ef0891
ensure so-yaml.py is updated during soup
2024-04-03 08:44:40 -04:00
m0duspwnens
a2b17d2348
move jinja to top
2024-02-14 14:27:41 -05:00
m0duspwnens
c1f467a068
handle airgap
2024-02-14 14:22:18 -05:00
m0duspwnens
79e98e508f
pass in UPDATE_DIR as a pillar
2024-02-14 13:28:12 -05:00
m0duspwnens
00f2374582
fix path for so-firewall
2024-02-13 15:43:02 -05:00
m0duspwnens
88786e8342
use file.copy to preserve perms
2024-02-13 15:05:09 -05:00
m0duspwnens
141fd49f02
use rsync
2024-02-13 14:27:22 -05:00
m0duspwnens
d6ac7a3286
fix the jinja
2024-02-13 13:31:34 -05:00
m0duspwnens
9175a73456
dont need $ for vars
2024-02-13 13:08:09 -05:00
m0duspwnens
1bde002f20
update case
2024-02-13 12:51:53 -05:00
m0duspwnens
5c9b1ab38b
copy with cp
2024-02-13 12:48:31 -05:00
m0duspwnens
b713771494
add back common soup_scripts state
2024-02-13 12:30:36 -05:00
m0duspwnens
3efaba1104
modify soup to update soup scripts without using salt
2024-02-13 11:04:26 -05:00
m0duspwnens
6b0fbe4634
include so-repo-sync in soup_manager_scripts state
2023-08-28 11:53:45 -04:00
Mike Reeves
801a5a6824
soup fix
2023-06-23 15:56:15 -04:00
m0duspwnens
268e07e2a2
remove jinja from soup scripts
2022-01-24 15:49:55 -05:00
Josh Patterson
Jason Ertel
Mike Reeves