vh
466f7aa4e6
elway's sudo upload did scp-as-user then `sudo mv`, and mv keeps the owner,
so every file it installed "as root" (systemd units, /etc configs, root-run
scripts) ended up owned by the SSH user. A sudoers drop-in installed that
way would be rejected by sudo outright.
elway:
- Sudo uploads now chown to root:root by default. Playbooks can override
with `upload.owner:` and ad-hoc runs with `--owner`. An owner is refused
on a non-sudo upload, and `--owner` outside an ad-hoc `--upload` is an
error rather than silently ignored.
- Ownership and mode are applied to the STAGED file, then a single mv
publishes it, so a failed chown can no longer leave the live path owned
by the SSH user. chown runs before chmod so setuid bits survive. A trap
removes the staged file on every exit path.
- A directory dest is refused before anything moves. mv would otherwise
drop the file inside the directory under a staging name.
- `mode` was spliced unquoted into the remote root shell line. It is now
validated as octal (^[0-7]{3,4}$) and shell-quoted, on both the sudo
and non-sudo paths.
- `mode` and `owner` must be quoted YAML strings. YAML 1.1 turns a bare
0644 into 420, a bare 1000:0 into 60000 and a bare yes into True, and
str() of each is a different value that looks valid. All 85 playbooks
already quote them.
- New preflight(): every step is resolved before any remote action. An
undefined var or a templated owner that resolves badly is now refused
up front, not after earlier steps have already changed the host.
scripts/fleet-ownership-audit.sh (new, read-only) finds files in root's
territory owned by a normal user. Tier A lists /etc, /usr/local, /root and
cron, judging symlinks by their target. Tier X covers files that root-run
units exec from /opt, /srv, /home or /volume1, reading drop-ins and quoted
paths. Tier B only summarises /opt app trees. A host that is unprivileged,
whose find fails, or whose run dies is reported INCOMPLETE (exit 5), never
clean. Completion is marked with a per-run nonce.
Verification: 24 unit tests in scripts/test_elway.py. Live checks on
esh-docker-vm: default lands root:root; the override lands infra-ops:adm at
4755 with setuid intact; a bad group fails with dest untouched and no
staging left; a directory dest is refused; a bad mode is refused before
any copy. Audit positive controls on nh3-dev (a drop-in-only root Exec, a
quoted path containing a space, a symlink to a user-owned target) were all
flagged; esh-docker-vm negative control was 0. Probes removed. Cross-model
bug-hunt (heid, Gróa arm + seat) findings folded.
50 lines
1.8 KiB
YAML
50 lines
1.8 KiB
YAML
# esh-docker-vm: install the pre-backup hook without the uptime-kuma block.
|
|
#
|
|
# Kuma moved to ana-docker on 2026-09-22. The old block's unguarded
|
|
# `docker ps | grep uptime.kuma` lookup then matched nothing, exited 1, and
|
|
# set -euo pipefail aborted the hook. resticprofile treats a failed run-before
|
|
# as fatal, so every nightly backup since 2026-09-22 01:00 was skipped.
|
|
#
|
|
# Rerunnable: the preserve step is `creates:`-guarded, and the upload only
|
|
# changes the file when the content differs.
|
|
|
|
steps:
|
|
- name: Preserve the pre-fix hook
|
|
sudo: true
|
|
shell: |
|
|
set -eu
|
|
install -d -m 0700 /var/lib/restic/repair-20260923
|
|
cp -p /etc/restic/pre-backup.sh /var/lib/restic/repair-20260923/pre-backup.sh
|
|
creates: /var/lib/restic/repair-20260923/pre-backup.sh
|
|
|
|
- name: Install the hook without the uptime-kuma block
|
|
sudo: true
|
|
upload:
|
|
src: configs/restic/esh-docker-vm/pre-backup.sh
|
|
dest: /etc/restic/pre-backup.sh
|
|
mode: '0700'
|
|
|
|
# Belt and braces: elway's sudo upload defaults to root:root since
|
|
# 2026-09-23 (before that it kept the SSH user's ownership). This hook is
|
|
# executed by root, so the verify below checks it either way.
|
|
- name: Make the hook root-owned
|
|
sudo: true
|
|
shell: chown root:root /etc/restic/pre-backup.sh
|
|
|
|
verify:
|
|
- name: Hook parses under bash
|
|
sudo: true
|
|
shell: bash -n /etc/restic/pre-backup.sh
|
|
|
|
- name: No uptime-kuma lookup left in the live hook
|
|
sudo: true
|
|
shell: "! grep -q 'UK_CONTAINER' /etc/restic/pre-backup.sh"
|
|
|
|
- name: Hook runs to completion (stage summary line reached)
|
|
sudo: true
|
|
shell: /etc/restic/pre-backup.sh 2>&1 | grep -q 'stage ready:'
|
|
|
|
- name: Hook is root:root 0700
|
|
sudo: true
|
|
shell: test "$(stat -c '%U:%G %a' /etc/restic/pre-backup.sh)" = "root:root 700"
|