search

cloudera / cloudera-scripts-for-log4j

Scripts for addressing log4j zero day security issue
Apache License 2.0
86 stars 68 forks source link

Script Scans all Parcels #11

Open belugabehr opened 2 years ago

belugabehr commented 2 years ago

Hello,

The script (by default) scan /opt/cloudera for jar/tar/war files. This has the affect of also modifying files which are not part of Cloudera's stack e.g. StreamSets managed by CM. Is there a way the script can check the top-level directories to ensure that they are Cloudera products before scanning?

Thanks.

belugabehr commented 2 years ago

Should be able to determine by inspecting the following file:

/opt/cloudera/<parcel>/meta/parcel.json
belugabehr commented 2 years ago 
    "description": "Cloudera Runtime",
    "displayName": "Cloudera Runtime",
    "extraVersionInfo": {
        "baseVersion": "cdh7.2.13",
        "fullVersion": "7.2.13-1.cdh7.2.13.p0.19580285-el7",
        "patchCount": "0"
    },
jtran-cloudera commented 2 years ago

Thanks for the report. We will think about how to handle this.

lhoss commented 2 years ago

And I'ld suggest, when working on such a feature, to add a flag (via a new ENV var?) to allow disabling patching the parcel .tar.gz alltogether

This would alleviate the issue with too small /tmp dirs, resp. non configurable tmp dirs for .tar.gz processing, see: https://github.com/cloudera/cloudera-scripts-for-log4j/issues/24#issuecomment-997813641