[8.17](backport #6144) Return actionable error message when enrolling #6421
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?s=60&v=4){kind=small}
* enhancement(4889): updated enroll command to reexec the command if the executing user and binary owner don't match, added tests * enhancement(4889): added savepassword function * enhancement(4889): removed user impersonation, implemented noop for windows, updated integration tests * enhancement(4889): added changelog * enhancement(4889): added windows implementation * enhancement(4889): added license headers * enhancement(4889): update test case to execute different commands based on os * enhancement(4889): ran mage clean * enhancement(4889): updated function name, updated integration tests * enhancmenet(4889): updated function name * enhancement(4889): updated function name, fixed test assertions * enhancement(4889): update error messages * enhancement(4889): ran mage update * enhancements(4889): fix integration test * enhancement(4889): remove commented code * enhancement(4889): commiting now, don't push though * enhancement(4889): added windows unit test * enhancement(4889): close test file * enhancement(4889): updated isOwnerExec function, added tests * enchancement(4889): added log in test * enhancement(4889): remove unused types * enhancement(4889): added test for isOwnerExec for windows * enhancement(4889): added unix tests, ran mage addLicenseHeaders * enhancement(4889): added testisfileownerunix test * enhancement(4889): added TestIsOwnerExecUnix test * enhancement(4889): updated test function name * enhancement(4889): set file ownership of the test file * enhancement(4889): remove unnecessary change * enhancment(4889): updated iOwnerExec windows test * enhancement(4889): fix file creation in tests * Update internal/pkg/agent/cmd/enroll.go Co-authored-by: Paolo Chilà <[email protected]> * Update internal/pkg/agent/cmd/enroll_match_fileowner_windows.go Co-authored-by: Paolo Chilà <[email protected]> * Update internal/pkg/agent/cmd/enroll_match_fileowner_unix.go Co-authored-by: Paolo Chilà <[email protected]> * enhancement(4889): updated summary and issue in changelog * enhancement(4889): updated variable name, wrap error when returning error * enhancement(4889): added comments describing isOwnerExec. fixed type problems with stat.Uid * enhancement(4889): refactored isOwnerExec return * enhancement(4889): differentiating between sid errors * enhancment(4889): removed redundant unit tests * enhancement(4889): update command execution in integration tests --------- Co-authored-by: Paolo Chilà <[email protected]> (cherry picked from commit c4835ca)
mergify
bot
requested review from
kaanyalti and
andrzej-stencel
and removed request for
a team
|
jlind23
approved these changes
Dec 20, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds checks to the enroll command to respond with an error message in case the user executing the command and the user that's the owner of the elastic program files don't match. Replaces #6038 based on the following comment
Why is it important?
Currently there are no checks in place to prevent or correct the situation where a user who is not the owner of the program files executes enroll. This leads to a broken state.
Checklist
[ ] I have made corresponding changes to the documentation[ ] I have made corresponding change to the default configuration files[ ] I have added tests that prove my fix is effective or that my feature works./changelog/fragmentsusing the changelog toolHow to test this PR locally
The testing steps are only for linux and mac
Related issues
enrollan unprivileged Agent as a privileged user #4889This is an automatic backport of pull request Return actionable error message when enrolling #6144 done by Mergify.