Skip to content

CFE-4590, ENT-13239: Override default directory permissions #5931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

CFE-4590, ENT-13239: Override default directory permissions #5931

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b959b5f
Added test for overriding default directory create mode
larsewi Nov 4, 2025
59827e8
Skip remaining string comparisons after successful match
larsewi Nov 4, 2025
928eb80
Added default_directory_create_mode to body agent control
larsewi Nov 4, 2025
01e1a5a
Replaced hardcoded directory create mode with DEFAULTMODE
larsewi Nov 4, 2025
3b554e8
Make sure the last configuration wins
larsewi Nov 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cf-agent/cf-agent.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1337,6 +1337,7 @@ static void KeepControlPromises(EvalContext *ctx, const Policy *policy, GenericA
{
Log(LOG_LEVEL_VERBOSE, "SET select_end_match_eof %s", (char *) value);
EvalContextSetSelectEndMatchEof(ctx, BooleanFromString(value));
continue;
Copy link
Contributor

@craigcomstock craigcomstock Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why? I don't understand the context or the reason for the change and what the change does.

I noticed around line 1141 there is another block that doesn't continue I wonder if this whole block of code needs to be audited for correct logic?

if (strcmp(cp->lval, CFA_CONTROLBODY[AGENT_CONTROL_ALLCLASSESREPORT].lval) == 0)

Copy link
Contributor Author

@larsewi larsewi Nov 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are checking if the string matches any of the possible attributes. Once we find a match, we don't need to check if it matches the remaining attributes, because we know implicitly that they will not match.

There is no change in behavior, just less CPU cycles wasted.

Copy link
Member

@nickanderson nickanderson Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feels like i am just showing what i dont know about the code

but, @larsewi your description there made me wonder if this would be affected:

body common control
{
   default_directory_create_mode => "000";
   default_directory_create_mode => "770";
}

It's a silly example, but in some policies the same attribtue is set differently in different contexts and multiple contexts might apply.

I just wanted to be sure that not continuing to check for the attribute will not affect this (in the above simple example, expect the last one to win).

Copy link
Contributor Author

@larsewi larsewi Nov 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think these breaks will affect multiple configurations of the default directory create mode. However, I added a line in the policy to test this, just in case. I will merge once the acceptance test workflow from GitHub Actions have passed.

}

if (strcmp(cp->lval, CFA_CONTROLBODY[AGENT_CONTROL_REPORTCLASSLOG].lval) == 0)
Expand Down