Puppet Support

When it says "with symlinks to Pulp" is that a symlink file in the tarball that is pointing at target path like: /var/lib/pulp/...?

No the symlinks are internal to the puppet module. They link some folders in the tests directory to the puppet module lib directory.

Thanks for explaining that. I understand why a use would want to do that. It's a little scary though because this could be used to exfiltrate data off of Pulp servers right? It could point to /my/sensistive/secret and expose a CA cert. Granted other selinux mechanisms should prevent kernel-level read access on those other files, but in the layered security model of security we're removing one layer.

Isn't there a puppet dependency mechanism that would allow a module that depends on other modules to express that at the puppet class or module level?

Thanks for explaining that. I understand why a use would want to do that. It's a little scary though because this could be used to exfiltrate data off of Pulp servers right? It could point to /my/sensistive/secret and expose a CA cert. Granted other selinux mechanisms should prevent kernel-level read access on those other files, but in the layered security model of security we're removing one layer.

I had the same concern around security.

Isn't there a puppet dependency mechanism that would allow a module that depends on other modules to express that at the puppet class or module level?

I'm not a puppet expert so I don't know. I would assume so though.

I think they should use the "dependencies" field for their modules metadata. It can also reference standard lib or puppetforge locations as I understand it. The docs are here: https://puppet.com/docs/puppet/6.2/modules_metadata.html#reference-4908

If that's the case is this CLOSED - NOTABUG?

recapping a convo from irc... This module isn't linking outside of itself, it's linking to another area within the tgz itself.

It would be possible to adjust selinux to allow for Pulp to make symlinks, and add code to "check that it's safe" in Pulp's application code. This is difficult to do correctly though and Pulp has had at least one (now resolved) CVE for similar implementation errors before. If a patch was available I would be OK to accept, but for the benefit and risk, I don't think it's something pulp_puppet should pursue.

Overall when the tarball is made, they could dereference the symlinks then. The user could apply this workaround before uploading things to Pulp also, even if they aren't the module author.