Christian Manivong
cf8ee38a90
CI / test (3.10) (push) Successful in 56s
CI / test (3.11) (push) Successful in 50s
CI / test (3.12) (push) Successful in 44s
CI / test (3.10) (pull_request) Successful in 42s
CI / test (3.11) (pull_request) Successful in 44s
CI / test (3.12) (pull_request) Successful in 53s
_sudo typed `echo '<password>' | sudo -S -p "" <command>` into netmiko's interactive shell. bash kept it in its history, so every poll wrote the sudo password into the login user's ~/.bash_history, and while the command ran it was in the process list for every local user (NetOrk/netork#1039). _sudo, _sudo_status and _run_privileged with a password now run on an exec channel like run_command(privileged=True): the password reaches sudo -S on stdin, there is no PTY to echo it, and the script starts with `exec </dev/null` so a non-prompting sudo leaves it unread. The whole command runs as root in one sh -c - before, only the part up to the first `;`, `&&` or `|` did. The exit status comes from the channel. The interactive session switches its history off before its first command. get_vpn_tunnels with a password reads `wg show all dump` from the exec channel instead of a temp file that held the private keys.
93 lines
4.4 KiB
Markdown
93 lines
4.4 KiB
Markdown
# Changelog
|
||
|
||
All notable changes to this project will be documented in this file.
|
||
|
||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||
|
||
## [Unreleased]
|
||
|
||
### Security
|
||
|
||
- `run_command(privileged=True, stdin=...)` raises `ValueError` while a sudo
|
||
password is set. `sudo -S` reads the password from stdin, and a sudo that does
|
||
not prompt (NOPASSWD, a cached timestamp) left it for the command, which read
|
||
it as the first line of the data: netOrk wrote it into a file that way
|
||
(NetOrk/netork#1029). Stage the data without privilege and have root install
|
||
that file. Without a sudo password (`sudo -n`) or for a root login, stdin
|
||
still goes to the command.
|
||
- The sudo password is no longer typed into the interactive shell
|
||
(NetOrk/netork#1039). Every privileged command ran there as
|
||
`echo '<password>' | sudo -S -p "" <command>`: bash kept it in its history,
|
||
so each poll wrote the password into the login user's `~/.bash_history`, and
|
||
while the command ran it was in the process list for every local user.
|
||
Privileged commands (`_sudo`, `_sudo_status`, and `_run_privileged` with a
|
||
sudo password) now run on an exec channel like `run_command(privileged=True)`:
|
||
the password reaches `sudo -S` on stdin, there is no PTY to echo it, and the
|
||
whole command runs as root in one `sh -c` (before, only the part up to the
|
||
first `;`, `&&` or `|` did, so `mv … && chown root:root …` failed its chown).
|
||
The interactive session also switches its history off before its first
|
||
command (` unset HISTFILE; set +o history`). **History files written before
|
||
this version may still hold the sudo password**: remove those lines from the
|
||
login user's `~/.bash_history` on your hosts and consider changing the
|
||
password. `_sudo_status` takes the exit status from the channel; it is `None`
|
||
only when the channel closed without one.
|
||
|
||
## [0.4.0] – 2026-10-08
|
||
|
||
### Added
|
||
|
||
- `get_virtual_ips()` through napalm-device-types' `VirtualIpsMixin` (4.2.0): the
|
||
addresses vip-manager and keepalived configuration lets float onto this host,
|
||
whether or not it holds them right now (NetOrk/netork#829). The command goes on
|
||
the exec channel (`run_command`): with its awk filter it is about 4 kB, past the
|
||
line the PTY reliably takes. Root first, then without it.
|
||
|
||
## [0.3.0] – 2026-10-08
|
||
|
||
### Removed
|
||
|
||
- `get_docker_info()`, `get_docker_outdated()`, `reconstruct_docker_run()` and
|
||
the `_docker_bin()` hook, with the image-ID helpers they used. netOrk reads
|
||
and handles containers itself over the Engine API, through
|
||
`open_container_engine()` (NetOrk/netork#765), and no longer calls them.
|
||
`run_device_action("fix_docker_permissions")` stays: letting the login user
|
||
use Docker is an OS action.
|
||
|
||
## [0.2.0] – 2026-10-07
|
||
|
||
### Added
|
||
|
||
- `run_command()` and `open_stream()`, the public command channel from
|
||
napalm-device-types 2.6.0: an exec channel on the existing SSH transport, so
|
||
no PTY, separate stderr and a real exit code. `privileged=True` runs as root
|
||
directly, through `sudo -S` with the password on stdin (never on the command
|
||
line), or through `sudo -n`, which fails instead of prompting.
|
||
- `ContainerEngineMixin`: `container_engines()` and `open_container_engine()`,
|
||
whose `open_api()` streams the Docker Engine API over `docker system
|
||
dial-stdio` (NetOrk/netork#765). The existing Docker methods are unchanged.
|
||
|
||
### Changed
|
||
|
||
- Requires napalm-device-types >= 2.6.0.
|
||
|
||
## [0.1.0] – 2026-05-29
|
||
|
||
### Added
|
||
|
||
- Initial release
|
||
- `LinuxDriver` inheriting from `napalm_device_types.OSDriver`
|
||
- SSH transport via Netmiko `linux` device type
|
||
- Auto-detection of package manager: `apt`, `dnf`, `yum`, `apk`, `pacman`
|
||
- Standard NAPALM methods: `get_facts()`, `get_interfaces()`, `get_interfaces_ip()`,
|
||
`get_arp_table()`, `get_config()`, `ping()`
|
||
- OS-specific methods: `get_packages()`, `get_pending_updates()`, `apply_updates()`,
|
||
`get_services()`, `get_users()`, `get_processes()`, `get_cron_jobs()`
|
||
- `apply_updates()` validates all package names against `^[a-zA-Z0-9_\-\+\.]+$`
|
||
to prevent shell injection before passing them to the package manager
|
||
- SysV fallback for `get_services()` on non-systemd systems
|
||
- Unit tests with mocked SSH connections
|
||
|
||
[Unreleased]: https://github.com/chrismanivong/napalm-linux/compare/v0.1.0...HEAD
|
||
[0.1.0]: https://github.com/chrismanivong/napalm-linux/releases/tag/v0.1.0
|