Custom Query (894 matches)

<Action ...> configuration entries bypass the Decisions' whitelist/blacklist filtering by the client.

A simple example:

<Bundle name='a'>
  <BoundAction name='a1' command='/usr/bin/touch /tmp/a1_executed' when='always' status='check' timing='post' />
</Bundle>

Then run bcfg2 -l whitelist. The Action's command will get executed, even though it's not whitelisted.

This behaviour doesn't seem to be documented. IMHO, the promise of white/blacklist safety is not fulfilled here. (Eg. I use Actions for setting up static routing using just the 'route' command, so an Action is the sole element of the Bundle, and, obviously, I need to control which hosts actually execute it).

I believe it happens in Client.Frame.Install(), where tool.BundleUpdated() and tool.BundleNotUpdated() are called unconditionally.

Also, in Client.Frame.Decide() some Actions get run regardless of their white/blacklist status. (Perhaps there are some other places where Actions can get run, but my understanding of the code is not good enough to find them.)

A partial workaround could be to add to the Bundle an artificial config file (crafted just to mirror the actual "volatile" configuration), and set the Action to when='modified'. This would still be fragile for some non-trivial Bundles and commands, though.

/mkd

We need to add Action entries to Snapshots to prevent this:

Failed to bind entry: Action googleearth
Handled 1 events in 0.000s
Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib/python2.5/threading.py", line 486, in __bootstrap_inner
    self.run()
  File "/usr/lib/python2.5/threading.py", line 446, in run
    self.__target(*self.__args, **self.__kwargs)
  File "/root/bcfg2/Bcfg2/Server/Plugins/Snapshots.py", line 79, in load_snapshot
    self.statistics_from_old_stats(metadata, data)
  File "/root/bcfg2/Bcfg2/Server/Plugins/Snapshots.py", line 98, in statistics_from_old_stats
    + build_snap_ent(entry)
  File "/root/bcfg2/Bcfg2/Server/Plugins/Snapshots.py", line 34, in build_snap_ent
    datafields[entry.tag]])
KeyError: 'Action'

lets say I have two bundles, [ bundle1, bundle2 ]

bundle1 contains an action with when='always'

I do

bcfg2 -I -b bundle2

I will be prompt for that action.

I believe this is a bug.