Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt software package repository here:
Description
I use hardened Debian servers. This include a default UMASK enforced to 027 (0640 for files).
This hardening is executed after the Debian installation.
So, /etc/apt/sources.list mode is 0644.
I have a state managing /etc/apt/sources.list.d/salt.list using pkgrepo.managed.
On every state.highstate the mode of /etc/apt/sources.list is modified to 0640 without any change reported.
Setup
use a debian:bullseye Docker container.
install Salt via Salt's repositories and apt-get install salt-minion.
delete all .list files in /etc/apt/sources.list.d/.
change the /etc/apt/sources.list mode to 0640 (simulate a different mode than the default UMASK).
run a salt-call --local state.apply test
check the /etc/apt/sources.list mode.
[ x] on-prem machine
[x ] VM (Virtualbox, KVM, etc. please specify)
[x ] VM running on a cloud service, please be explicit and add details
[x ] container (Kubernetes, Docker, containerd, etc. please specify)
[ ] or a combination, please be explicit
[ ] jails if it is FreeBSD
[ ] classic packaging
[x ] onedir packaging
[ ] used bootstrap to install
Steps to Reproduce the behavior
I use docker run -it --rm debian:bullseye , install Salt and remove the .list file
So,
1: the file mode of /etc/apt/sources.list is modified even though it is not managed by the state.
2: it seems a change is detected due to the bad .split(), but nothing is reported.
fun fact, if I sort [arch=amd64 signed-by=xxxx], nothing append. no mode change, nothing.
65703 is caused by indexing issues. that issue is going to be fixed in https://github.com/saltstack/salt/pull/66164 by switching to an OrderedDict and just dropping the weird indexing that was implemented before.
Description I use hardened Debian servers. This include a default UMASK enforced to 027 (0640 for files). This hardening is executed after the Debian installation. So,
/etc/apt/sources.list
mode is0644
.I have a state managing
/etc/apt/sources.list.d/salt.list
using pkgrepo.managed. On every state.highstate the mode of/etc/apt/sources.list
is modified to 0640 without any change reported.Setup use a debian:bullseye Docker container. install Salt via Salt's repositories and apt-get install salt-minion. delete all .list files in
/etc/apt/sources.list.d/
.create a state like
change the
/etc/apt/sources.list
mode to 0640 (simulate a different mode than the default UMASK). run asalt-call --local state.apply test
check the/etc/apt/sources.list
mode.Steps to Reproduce the behavior I use
docker run -it --rm debian:bullseye
, install Salt and remove the .list fileThen create the state and
Versions Report
Additional context If I add
just before the
if
statement here https://github.com/saltstack/salt/blob/master/salt/states/pkgrepo.py#L521if sanitizedsplit != reposplit:
I have
[]
are not excluded.So, 1: the file mode of
/etc/apt/sources.list
is modified even though it is not managed by the state. 2: it seems a change is detected due to the bad .split(), but nothing is reported.fun fact, if I sort [arch=amd64 signed-by=xxxx], nothing append. no mode change, nothing.