From ce233aa2a511bf6818f28c226144ec5b05a468ee Mon Sep 17 00:00:00 2001 From: Markus Roberts Date: Wed, 28 Apr 2010 15:39:39 -0700 Subject: Write ssh_authorized_keys as user This is a targeted fix to the issue of permissions when writing ssh authorized key files by 1) requiring that an existing users be specified on the resource and 2) doing the write as that user. It's based on Michael DeHaan's initial implementation of Luke's idea, but with a number of simplifications (mostly by testing necessary conditions as early as possible so the code isn't cluttered up with a lot of checks). --- lib/puppet/provider/ssh_authorized_key/parsed.rb | 38 ++++++------------------ 1 file changed, 9 insertions(+), 29 deletions(-) (limited to 'lib/puppet') diff --git a/lib/puppet/provider/ssh_authorized_key/parsed.rb b/lib/puppet/provider/ssh_authorized_key/parsed.rb index b435c513c..fb4d0956e 100644 --- a/lib/puppet/provider/ssh_authorized_key/parsed.rb +++ b/lib/puppet/provider/ssh_authorized_key/parsed.rb @@ -62,36 +62,16 @@ Puppet::Type.type(:ssh_authorized_key).provide(:parsed, end def flush - # As path expansion had to be moved in the provider, we cannot generate new file - # resources and thus have to chown and chmod here. It smells hackish. - - # Create target's parent directory if nonexistant - if target - dir = File.dirname(target) - if not File.exist? dir - Puppet.debug("Creating directory %s which did not exist" % dir) - Dir.mkdir(dir, dir_perm) - end - end - - # Generate the file - super - - # Ensure correct permissions - if target and user - uid = Puppet::Util.uid(user) - - if uid - File.chown(uid, nil, dir) - File.chown(uid, nil, target) - else - raise Puppet::Error, "Specified user does not exist" - end - end - - if target - File.chmod(file_perm, target) + raise Puppet::Error, "Cannot write SSH authorized keys without user" unless user + raise Puppet::Error, "User '#{user}' does not exist" unless uid = Puppet::Util.uid(user) + unless File.exist?(dir = File.dirname(target)) + Puppet.debug "Creating #{dir}" + Dir.mkdir(dir, dir_perm) + File.chown(uid, nil, dir) end + Puppet::Util::SUIDManager.asuser(user) { super } + File.chown(uid, nil, target) + File.chmod(file_perm, target) end # parse sshv2 option strings, wich is a comma separated list of -- cgit