1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
|
# Commands bodies
bundle agent daemonize(command)
# @brief Run a command as a daemon. I.e., fully detaches from Cfengine.
# @param command The command to run detached
# Note: There will be no output from the command reported by cf-agent. This
# bundle has no effect on windows
#
# **Example:**
# ```cf3
# methods:
# "Launch Daemon"
# usebundle => daemonize("/bin/sleep 30");
# ```
{
commands:
!windows::
"exec 1>&-; exec 2>&-; $(command) &"
contain => in_shell;
reports:
"windows.(DEBUG|DEBUG_$(this.bundle))"::
"DEBUG $(this.bundle): This bundle does not support Windows";
}
##-------------------------------------------------------
## contain
##-------------------------------------------------------
body contain powershell
# @brief Run command with powershell (windows only)
#
# **Example:**
#
# ```cf3
# commands:
# windows::
# 'schtasks /DELETE /TN "$(_taskname)" /F'
# contain => powershell;
# ```
#
# **History:**
#
# * Introduced in 3.17.0
{
useshell => "powershell";
}
body contain silent
# @brief suppress command output
{
no_output => "true";
}
##
body contain in_dir(dir)
# @brief run command after switching to directory "dir"
# @param dir directory to change into
#
# **Example:**
#
# ```cf3
# commands:
# "/bin/pwd"
# contain => in_dir("/tmp");
# ```
{
chdir => "$(dir)";
}
##
body contain in_dir_shell(dir)
# @brief run command after switching to directory "dir" with full shell
# @param dir directory to change into
#
# **Example:**
#
# ```cf3
# commands:
# "/bin/pwd | /bin/cat"
# contain => in_dir_shell("/tmp");
# ```
{
chdir => "$(dir)";
useshell => "true"; # canonical "useshell" but this is backwards-compatible
}
##
body contain silent_in_dir(dir)
# @brief run command after switching to directory and suppress output
# @param dir directory to change into
#
# **Example:**
#
# ```cf3
# "/bin/pwd"
# contain => silent_in_dir("/tmp");
# ```
{
chdir => "$(dir)";
no_output => "true";
}
##
body contain in_shell
# @brief run command in shell
#
# **Example:**
#
# ```cf3
# commands:
# "/bin/pwd | /bin/cat"
# contain => in_shell;
# ```
{
useshell => "true"; # canonical "useshell" but this is backwards-compatible
}
##
body contain in_shell_bg
# @brief deprecated
# This bundle previously had an invalid background attribute that was caught by
# parser strictness enhancements. Backgrounding is handeled by the body action
# background attribute.
{
useshell => "true"; # canonical "useshell" but this is backwards-compatible
}
##
body contain in_shell_and_silent
# @brief run command in shell and suppress output
#
# **Example:**
#
# ```cf3
# commands:
# "/bin/pwd | /bin/cat"
# contain => in_shell_and_silent,
# comment => "Silently run command in shell";
# ```
{
useshell => "true"; # canonical "useshell" but this is backwards-compatible
no_output => "true";
}
##
body contain in_dir_shell_and_silent(dir)
# @brief run command in shell after switching to 'dir' and suppress output
# @param dir directory to change into
#
# **Example:**
#
# ```cf3
# commands:
# "/bin/pwd | /bin/cat"
# contain => in_dir_shell_and_silent("/tmp"),
# comment => "Silently run command in shell";
# ```
{
useshell => "true"; # canonical "useshell" but this is backwards-compatible
no_output => "true";
chdir => "$(dir)";
}
##
body contain setuid(owner)
# @brief run command as specified user
# @param owner username or uid to run command as
#
# **Example:**
#
# ```cf3
# commands:
# "/usr/bin/id"
# contain => setuid("apache");
# "/usr/bin/id"
# contain => setuid("503");
# ```
{
exec_owner => "$(owner)";
}
##
body contain setuid_sh(owner)
# @brief run command as specified user in shell
# @param owner username or uid to run command as
#
# **Example:**
#
# ```cf3
# commands:
# "/usr/bin/id | /bin/cat"
# contain => setuid("apache");
# "/usr/bin/id | /bin/cat"
# contain => setuid("503");
# ```
{
exec_owner => "$(owner)";
useshell => "true"; # canonical "useshell" but this is backwards-compatible
}
##
body contain setuidgid_dir(owner,group,dir)
# @brief run command as specified owner and group in shell
# @param owner username or uid to run command as
# @param group groupname or gid to run command as
# @param dir directory to run command from
{
exec_owner => "$(owner)";
exec_group => "$(group)";
chdir => "$(dir)";
}
##
body contain setuidgid_sh(owner,group)
# @brief run command as specified owner and group in shell
# @param owner username or uid to run command as
# @param group groupname or gid to run command as
{
exec_owner => "$(owner)";
exec_group => "$(group)";
useshell => "true"; # canonical "useshell" but this is backwards-compatible
}
##
body contain jail(owner,jail_root,dir)
# @brief run command as specified user in specified directory of jail
# @param owner username or uid to run command as
# @param jail_root path that will be the root directory for the process
# @param dir directory to change to before running command (must be within 'jail_root')
{
exec_owner => "$(owner)";
useshell => "true"; # canonical "useshell" but this is backwards-compatible
chdir => "$(dir)";
chroot => "$(jail_root)";
}
##
body contain setuid_umask(owner, umask)
# @brief run command as specified user with umask
#
#
# | Valid Values | Umask | Octal (files) | Symbolic (files) | Octal (dirs) | Symbolic (dirs) |
# |--------------|-------|-------|-------------|-------|-------------|
# | `0` | `000` | `666` | `(rw-rw-rw-)` | `777` | `(rwxrwxrwx)` |
# | `002` | `002` | `664` | `(rw-rw-r--)` | `775` | `(rwxrwxr-x)` |
# | `22`, `022` | `022` | `644` | `(rw-r--r--)` | `755` | `(rwxr-xr-x)` |
# | `27`, `027` | `027` | `640` | `(rw-r-----)` | `750` | `(rwxr-x---)` |
# | `77`, `077` | `077` | `600` | `(rw-------)` | `700` | `(rwx------)` |
# | `72`, `072` | `072` | `604` | `(rw----r--)` | `705` | `(rwx---r-x)` |
#
# @param owner username or uid to run command as
# @param umask controls permissions of created files and directories
#
# **Example:**
#
# ```cf3
# commands:
# "/usr/bin/git pull"
# contain => setuid_umask("git", "022");
# ```
{
exec_owner => "$(owner)";
umask => "$(umask)";
}
body contain setuid_gid_umask(uid, gid, umask)
# @brief run command as specified user with umask
#
#
# | Valid Values | Umask | Octal (files) | Symbolic (files) | Octal (dirs) | Symbolic (dirs) |
# |--------------|-------|-------|-------------|-------|-------------|
# | `0` | `000` | `666` | `(rw-rw-rw-)` | `777` | `(rwxrwxrwx)` |
# | `002` | `002` | `664` | `(rw-rw-r--)` | `775` | `(rwxrwxr-x)` |
# | `22`, `022` | `022` | `644` | `(rw-r--r--)` | `755` | `(rwxr-xr-x)` |
# | `27`, `027` | `027` | `640` | `(rw-r-----)` | `750` | `(rwxr-x---)` |
# | `77`, `077` | `077` | `600` | `(rw-------)` | `700` | `(rwx------)` |
# | `72`, `072` | `072` | `604` | `(rw----r--)` | `705` | `(rwx---r-x)` |
#
# @param uid username or uid to run command as
# @param gid group name or gid to run command as
# @param umask controls permissions of created files and directories
#
# **Example:**
#
# ```cf3
# commands:
# "/usr/bin/git pull"
# contain => setuid_gid_umask("git", "minions", "022");
# ```
{
exec_owner => "$(uid)";
exec_group => "$(uid)";
umask => "$(umask)";
}
|
