Skip to content

CFE-4708: Added support for a path-augment to specify files to ship beyond the extension-matching #3204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SimonThalvorsen wants to merge 2 commits into
base: master
Choose a base branch
from
Open

CFE-4708: Added support for a path-augment to specify files to ship beyond the extension-matching #3204

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9d146d0
Added support for a path-augment to specify files to ship beyond just…
SimonThalvorsen Aug 21, 2026
8230537
Gate input_paths_extra behind validated_updates_ready
nickanderson Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions cfe_internal/update/update_policy.cf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,16 @@ bundle agent cfe_internal_update_policy_cpv
comment => "Symlink to Python we found (if any)",
handle => "cfe_internal_update_policy_python_symlink";

"input_paths_extra_safe" -> { "CFE-4708" }
slist => filter(
"^.*\.\..*$", "update_def.input_paths_extra", "true", "true", 999
),
comment => concat(
"input_paths_extra with any entries containing a '..'",
" path-traversal segment dropped, since it's copied both",
" from the policy server and to every client verbatim."
);

classes:
"validated_updates_ready"
expression => "cfengine_internal_disable_cf_promises_validated",
Expand All @@ -237,6 +247,14 @@ bundle agent cfe_internal_update_policy_cpv
expression => "local_files_ok",
classes => u_if_else("files_ok", "files_ok");

"have_input_paths_extra"
expression => some(".*", "input_paths_extra_safe"),
comment => concat(
"True if input_paths_extra (CFE-4708) has any entries",
" so the per-path copy can be skipped when the feature",
" is not in use."
);

files:
!am_policy_hub::
# policy hub should not alter inputs/ uneccessary
Expand Down Expand Up @@ -273,6 +291,20 @@ bundle agent cfe_internal_update_policy_cpv
depth_search => u_recurse("inf"),
action => u_immediate;

"$(inputs_dir)/$(input_paths_extra_safe)"
comment => concat(
"Copy an explicitly listed extra file (input_paths_extra)",
" from the master source when a new policy validation is",
" acquired, for files not covered by input_name_patterns."
),
handle => "cfe_internal_update_policy_files_input_paths_extra",
if => "have_input_paths_extra",
copy_from => u_remote_dcp_missing_ok(
"$(master_location)/$(input_paths_extra_safe)",
@(update_def.policy_servers)
),
action => u_immediate;

update_inputs_not_kept::
"$(inputs_dir)/cf_promises_validated" -> { "CFE-2587" }
delete => u_tidy,
Expand Down
9 changes: 9 additions & 0 deletions controls/update_def.cf.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,15 @@ bundle common update_def
comment => "Additional filename patterns to copy during policy update.",
if => not( isvariable( "input_name_patterns_extra" ) );

"input_paths_extra" -> { "CFE-4708" }
slist => {},
comment => concat("Additional literal file paths (relative to the",
" policy set root) to copy during policy update,",
" regardless of input_name_patterns[_extra]. Lets a",
" specific file be included without widening the",
" extension-based patterns for the whole policy set."),
if => not( isvariable( "input_paths_extra" ) );

# the permissions for your masterfiles files (not dirs), which will propagate to inputs
"masterfiles_perms_mode_not_dir" -> { "CFE-951" }
string => "0600",
Expand Down
Loading