Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-2732

Validation of Exec-Attribute user limits usability with non-root user.

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: PUP 3.6.1
    • Fix Version/s: PUP 3.7.0
    • Component/s: Types and Providers
    • Labels:
      None
    • Template:

      Description

      Our customer will only use Puppet if all necessary operations are possible running Puppet without root privileges. Actually Puppet agent validates the user attribute of exec ressource that way, that it's fully unsupported if running without root user. Doing so, the following error message is printed and execution aborted:

      Error: Failed to apply catalog: Parameter user failed on Exec[test]: Only root can execute commands as other users at /etc/puppet/manifests/test.pp:8
      Wrapped exception:
      Only root can execute commands as other users
      

      Unfortunately many modules use this exec attribute so we had to rewrite or modify them all which makes Puppets great effort of prebuild model code quite useless.
      Using such modules and running Puppet without root should be possible if the given exec user is the same user already running the agent. In that case no user change so no root privileges are necessary.

      So in my opinion the user attribute validation shouldn't fail if the executing user isn't root and the given exec user is the actually running.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                joshua.partlow Joshua Partlow
                Reporter:
                sk Stefan Kahlhöfer
                QA Contact:
                Eric Thompson
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Zendesk Support

                    Time Tracking

                    Estimated:
                    Original Estimate - 1 day
                    1d
                    Remaining:
                    Remaining Estimate - 1 day
                    1d
                    Logged:
                    Time Spent - Not Specified
                    Not Specified