Skip to content

Stopped enforcing permission management of $(sys.workdir)/share/GUI #3033

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nickanderson merged 1 commit into from
Aug 14, 2025
Merged

Stopped enforcing permission management of $(sys.workdir)/share/GUI #3033

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions MPF.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1945,6 +1945,26 @@ Primarily for developer convenience, this setting allows you to easily disable t

* Added in CFEngine 3.12.0

### Enable permission enforcement for files under WORKDIR/share/GUI

The MPF used to actively enforce permissions of files and directories under `$(sys.workdir)/share/GUI`, to re-enable this active permission enforcement define the class `default:mpf_enforce_workdir_share_gui_perms`.

For example, to define it via Augments for CFEngine Enterprise Hubs:

```json
{
"classes": {
"default:mpf_enforce_workdir_share_gui_perms": {
"class_expressions": [
"enterprise_edition.am_policy_hub::"
]
}
}
}
```

* Added in CFEngine 3.27.0

### Configure Enterprise Mission Portal Apache SSLProtocol

This directive can be used to control which versions of the SSL/TLS protocol will be accepted in new connections.
Expand Down
7 changes: 4 additions & 3 deletions cfe_internal/enterprise/CFE_knowledge.cf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,12 +346,13 @@ bundle agent cfe_internal_setup_knowledge
$(def.cf_apache_user) then users will not be able to change
ldap settings.";


"$(sys.workdir)/share/GUI/."
handle => "cfe_internal_setup_knowledge_files_workdir_share_gui_perms",
perms => mog("0400", "root", "root" ),
depth_search => recurse_basedir("inf"),
comment => "No Mission Portal code in share needs to be accessed by
anyone";
comment => concat( "No Mission Portal code in share needs to be accessed",
" by anyone" ),
if => "mpf_enforce_workdir_share_gui_perms";

"$(sys.workdir)/." -> { "ENT-3299" }
perms => mog("755", "root", "root"),
Expand Down