From 60d72834f4c68779e2d36457cbd870b09783566b Mon Sep 17 00:00:00 2001 From: Nick Anderson Date: Thu, 22 Oct 2026 12:40:30 -0500 Subject: [PATCH] Stopped hub permissions policy from making old binaries in the PostgreSQL upgrade backup non-executable Ticket: ENT-14899 Changelog: Title (cherry picked from commit a9d1221c4d370ee3ca18e1778984018daf8a7732) --- cfe_internal/enterprise/CFE_knowledge.cf | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/cfe_internal/enterprise/CFE_knowledge.cf b/cfe_internal/enterprise/CFE_knowledge.cf index d8fdb60aae..81ea61414f 100644 --- a/cfe_internal/enterprise/CFE_knowledge.cf +++ b/cfe_internal/enterprise/CFE_knowledge.cf @@ -405,6 +405,10 @@ bundle agent cfe_internal_permissions # nonstandard directories in statedir "_statedir_standard_perm_exceptions" slist => { "pg", "cf-execd.sockets" }; + # The hub package upgrade copies the old binaries here; they must stay + # executable for the database migration (ENT-14899) + "_pg_dir_perm_exceptions" slist => { "backup" }; + # Derive the users that should be able to access cf-execd sockets "_cf_execd_socket_allow_users" slist => { @(def.control_executor_runagent_socket_allow_users) }; @@ -471,13 +475,17 @@ bundle agent cfe_internal_permissions "$(sys.statedir)/pg/." -> { "CFE-951" } perms => mog("0600", "cfpostgres", "cfpostgres"), - depth_search => recurse_with_base(inf), + depth_search => recurse_with_base_except( + inf, @(_pg_dir_perm_exceptions) + ), file_select => not_dir, comment => "No one except for the database user needs to access where the db is installed."; "$(sys.statedir)/pg/." -> { "CFE-951" } perms => mog("0700", "cfpostgres", "cfpostgres"), - depth_search => recurse_with_base(inf), + depth_search => recurse_with_base_except( + inf, @(_pg_dir_perm_exceptions) + ), file_select => dirs, comment => "No one except for the database user needs to access where the db is installed."; @@ -583,6 +591,18 @@ body acl cf_execd_socket_runagent_acl(aces) } ############################################################################# +body depth_search recurse_with_base_except(d, exceptions) +# @brief Recurse `d` levels (including basedir, excluding directories on other +# devices) excluding `exceptions` +# @param `d` Levels to descend in recursion +# @param `exceptions` List of directories to exclude from depth search +{ + depth => "$(d)"; + xdev => "true"; + include_basedir => "true"; + exclude_dirs => { @(exceptions) }; +} + body depth_search recurse_except(d, exceptions) # @breif Recurse (across device boundaires) `d` levels (excluding basedir) excluding `exceptions` # @param `d` Levels to decend in recursion