Christian Manivong
108f6fb3ca
CI / test (3.10) (push) Successful in 46s
CI / test (3.11) (push) Successful in 39s
CI / test (3.12) (push) Successful in 53s
CI / test (3.10) (pull_request) Successful in 44s
CI / test (3.11) (pull_request) Successful in 47s
CI / test (3.12) (pull_request) Successful in 47s
Now that a whole _sudo line runs as root, `mv /tmp/netork_snmpd.conf /etc/snmp/snmpd.conf && chown root:root … && chmod 644 …` would have let a local user plant a symlink at the fixed /tmp path and have root's chown and chmod follow it (e.g. to /etc/shadow). The same held for 00proxy. _install_file_as_root stages the content unprivileged in a fresh mktemp file (umask 077), checks the path it got back, and root installs it as a new regular file next to the target and renames it over: nothing root runs follows a symlink or changes the owner or mode of an existing path. Nothing runs as root when staging failed. get_vpn_tunnels always reads `wg show all dump` from the exec channel; the predictable /tmp/.netork_wg_<hash> file holding the private keys is gone.
104 lines
5.2 KiB
Markdown
104 lines
5.2 KiB
Markdown
# Changelog
|
||
|
||
All notable changes to this project will be documented in this file.
|
||
|
||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||
|
||
## [Unreleased]
|
||
|
||
### Security
|
||
|
||
- `run_command(privileged=True, stdin=...)` raises `ValueError` while a sudo
|
||
password is set. `sudo -S` reads the password from stdin, and a sudo that does
|
||
not prompt (NOPASSWD, a cached timestamp) left it for the command, which read
|
||
it as the first line of the data: netOrk wrote it into a file that way
|
||
(NetOrk/netork#1029). Stage the data without privilege and have root install
|
||
that file. Without a sudo password (`sudo -n`) or for a root login, stdin
|
||
still goes to the command.
|
||
- The sudo password is no longer typed into the interactive shell
|
||
(NetOrk/netork#1039). Every privileged command ran there as
|
||
`echo '<password>' | sudo -S -p "" <command>`: bash kept it in its history,
|
||
so each poll wrote the password into the login user's `~/.bash_history`, and
|
||
while the command ran it was in the process list for every local user.
|
||
Privileged commands (`_sudo`, `_sudo_status`, and `_run_privileged` with a
|
||
sudo password) now run on an exec channel like `run_command(privileged=True)`:
|
||
the password reaches `sudo -S` on stdin, there is no PTY to echo it, and the
|
||
whole command runs as root in one `sh -c` (before, only the part up to the
|
||
first `;`, `&&` or `|` did, so `mv … && chown root:root …` failed its chown).
|
||
The interactive session also switches its history off before its first
|
||
command (` unset HISTFILE; set +o history`). **History files written before
|
||
this version may still hold the sudo password**: remove those lines from the
|
||
login user's `~/.bash_history` on your hosts and consider changing the
|
||
password. `_sudo_status` takes the exit status from the channel; it is `None`
|
||
only when the channel closed without one.
|
||
- The snmpd and apt proxy fixes no longer stage their files at a fixed path in
|
||
/tmp (`/tmp/netork_snmpd.conf`, `/tmp/netork_00proxy`) and then `mv`,
|
||
`chown` and `chmod` them as root. Another local user could create that path
|
||
first as a symlink, for example to `/etc/shadow`, and root's `chown`/`chmod`
|
||
followed it. The content now goes to a fresh `mktemp` file under `umask 077`,
|
||
written without privilege, and root `install`s it as a new file owned by root
|
||
(mode 644) next to the target and renames it into place
|
||
(`_install_file_as_root`). Nothing runs as root when staging failed.
|
||
- `get_vpn_tunnels()` without a sudo password no longer writes `wg show all dump`
|
||
(which includes the interfaces' private keys) to the predictable
|
||
`/tmp/.netork_wg_<hash>`; the dump comes straight from the exec channel.
|
||
|
||
## [0.4.0] – 2026-10-08
|
||
|
||
### Added
|
||
|
||
- `get_virtual_ips()` through napalm-device-types' `VirtualIpsMixin` (4.2.0): the
|
||
addresses vip-manager and keepalived configuration lets float onto this host,
|
||
whether or not it holds them right now (NetOrk/netork#829). The command goes on
|
||
the exec channel (`run_command`): with its awk filter it is about 4 kB, past the
|
||
line the PTY reliably takes. Root first, then without it.
|
||
|
||
## [0.3.0] – 2026-10-08
|
||
|
||
### Removed
|
||
|
||
- `get_docker_info()`, `get_docker_outdated()`, `reconstruct_docker_run()` and
|
||
the `_docker_bin()` hook, with the image-ID helpers they used. netOrk reads
|
||
and handles containers itself over the Engine API, through
|
||
`open_container_engine()` (NetOrk/netork#765), and no longer calls them.
|
||
`run_device_action("fix_docker_permissions")` stays: letting the login user
|
||
use Docker is an OS action.
|
||
|
||
## [0.2.0] – 2026-10-07
|
||
|
||
### Added
|
||
|
||
- `run_command()` and `open_stream()`, the public command channel from
|
||
napalm-device-types 2.6.0: an exec channel on the existing SSH transport, so
|
||
no PTY, separate stderr and a real exit code. `privileged=True` runs as root
|
||
directly, through `sudo -S` with the password on stdin (never on the command
|
||
line), or through `sudo -n`, which fails instead of prompting.
|
||
- `ContainerEngineMixin`: `container_engines()` and `open_container_engine()`,
|
||
whose `open_api()` streams the Docker Engine API over `docker system
|
||
dial-stdio` (NetOrk/netork#765). The existing Docker methods are unchanged.
|
||
|
||
### Changed
|
||
|
||
- Requires napalm-device-types >= 2.6.0.
|
||
|
||
## [0.1.0] – 2026-05-29
|
||
|
||
### Added
|
||
|
||
- Initial release
|
||
- `LinuxDriver` inheriting from `napalm_device_types.OSDriver`
|
||
- SSH transport via Netmiko `linux` device type
|
||
- Auto-detection of package manager: `apt`, `dnf`, `yum`, `apk`, `pacman`
|
||
- Standard NAPALM methods: `get_facts()`, `get_interfaces()`, `get_interfaces_ip()`,
|
||
`get_arp_table()`, `get_config()`, `ping()`
|
||
- OS-specific methods: `get_packages()`, `get_pending_updates()`, `apply_updates()`,
|
||
`get_services()`, `get_users()`, `get_processes()`, `get_cron_jobs()`
|
||
- `apply_updates()` validates all package names against `^[a-zA-Z0-9_\-\+\.]+$`
|
||
to prevent shell injection before passing them to the package manager
|
||
- SysV fallback for `get_services()` on non-systemd systems
|
||
- Unit tests with mocked SSH connections
|
||
|
||
[Unreleased]: https://github.com/chrismanivong/napalm-linux/compare/v0.1.0...HEAD
|
||
[0.1.0]: https://github.com/chrismanivong/napalm-linux/releases/tag/v0.1.0
|