Jira (PUP-6729) NTFS permissions should be recalculated given SYSTEM is an implicit member of local Administrators

[Glenn Sarti (JIRA)]

Title: Message Title

Glenn Sarti commented on PUP-6729   Re: NTFS permissions should be recalculated given SYSTEM is an implicit member of local Administrators After working some more with the changes Ethan Brown has suggested, I'm beginning to come to the conclusion that this should no longer be worked on. 1. As Ethan pointed out, manage_internal_file_permissions is now set to false by default by the Windows MSI Installer (https://github.com/puppetlabs/puppet-agent-private/pull/9). This means the code that would "break" perms for both this (PUP-6729) and PUP-8939 now longer executes, by default. 2. The remeditation for https://puppet.com/security/cve/CVE-2018-6513 changes the owner to the correct file permissions (so PUP-6729 and PUP-8939 are no longer issues) so "broken" installations are automagically fixed too — *If manage_internal_file_permissions is set to true.* 1. Using the technique Ethan suggested to change the Root username detection works, however not all settings set an owner by default. For example, here's a list of file_settings when you run Puppet (SHA 2b08424711b7ea27824b241af6b1cffebbfd159e) This lists the resource, Owner to set (o=) and Group to set (g=) File[C:/ProgramData/PuppetLabs/puppet/etc] o= g= File[C:/ProgramData/PuppetLabs/code] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/var/log] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/cache/state] o= g= File[C:/ProgramData/PuppetLabs/puppet/var/run] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/cache/lib] o= g= File[C:/ProgramData/PuppetLabs/puppet/etc/hiera.yaml] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/preview] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/public_keys] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/certificate_requests] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/private] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys/win-hbiod5i9gso.localdomain.pem] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/etc/ssl/public_keys/win-hbiod5i9gso.localdomain.pem] o=S-1-5-32-544 g= File[C:/ProgramData/PuppetLabs/puppet/cache/state/state.yaml] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/client_yaml] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/client_data] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/clientbucket] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/state/last_run_summary.yaml] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/state/last_run_report.yaml] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/state/graphs] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/lib] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/facts.d] o= g= File[C:/ProgramData/PuppetLabs/puppet/cache/locales] o= g= Note there are some directories and files which do not have an Owner set, and some of those items have been known to cause issues in PUP-8939 (e.g. cache/clientbucket and C:/ProgramData/PuppetLabs/puppet/cache/state) This means in order to ensure that PUP-8939 is not hit, we'd need to set the owner for all file and directory settings, on windows to "root", if not already set, and the user is an Administrator. This assumes there are no edge cases we haven't thought of here, and there are no side-effects we don't know of. And to be honest this is one the things the CVE remedation did anyway. Proposed solution 1. Change the default for manage_internal_file_permissions to be false on Windows. This would bring Puppet into line with puppet-agent packaging i.e. Change https://github.com/puppetlabs/puppet/blob/707a61cc1263113ece292d32c320ab4d065dd6c1/lib/puppet/defaults.rb#L293 to {{ :default => ! Puppet::Features.windows? }} 2. Potentially add a warning that opting into this behaviour i.e. manage_internal_file_permissions = true may have unintended consequences when running e.g. Psuedo code if (manage_internal_file_permissions && Puppet::Features.windows? && Puppet::Features.root?) { warn('Are you sure about this?') } Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.