mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Activity Actions

* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
All checks were successful
CI / test (push) Successful in 41s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 9m2s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 13m39s
Details
Lint / test (push) Successful in 39s
Details

Browse source 
* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
 * Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
This commit is contained in:
Miguel Jacq 2026-07-13 10:15:43 +10:00
parent da0d8851d3
commit 5bf247c485
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
9 changed files with 823 additions and 391 deletions
Download patch file Download diff file Expand all files Collapse all files

6
rpm/enroll.spec
View file

@ -1,4 +1,4 @@
%global upstream_version 0.7.0
%global upstream_version 0.8.0
Name: enroll
Version: %{upstream_version}
@ -43,6 +43,10 @@ Enroll a server's running state retrospectively into Ansible.
%{_bindir}/enroll
%changelog
* Mon Jul 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
- Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
- Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
* Sun Jul 05 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- BREAKING CHANGE: Remove the `enroll diff --enforce` option. Enroll no longer applies the old harvest state locally to repair drift; this avoids the risk of enforcing a potentially malicious or tampered harvest. To restore baseline state, regenerate a manifest from the trusted harvest and apply it yourself, or compare two `enroll diff` runs and act on the result.
- BREAKING CHANGE: Group all package and systemd-unit roles into Debian Section/RPM Group roles by default, including managed config files and unit state. This mode is not used if `--fqdn` or `--no-common-roles` is set, in which case, the traditional behaviour of preserving one role per package/unit is used instead.