rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Parse macOS postinstall conf without eval

Browse Source 
Read KEY=VALUE lines from /tmp/probo-agent.conf directly so a
user-controlled temp file cannot execute arbitrary shell as root.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-26 09:34:50 -07:00
parent 75051cc150
commit 842081b66e
1 changed files with 32 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
cmd/probo-agent/installer/macos/scripts/postinstall
View File

@@ -46,20 +46,41 @@ chmod 0700 "${STATE_DIR}"
# PROBO_ENROLLMENT_TOKEN=<token> # PROBO_ENROLLMENT_TOKEN=<token>
# PROBO_NO_AUTO_UPDATE=true # PROBO_NO_AUTO_UPDATE=true
# #
# We source the file in a subshell so a malformed line can never # Parse KEY=VALUE lines without sourcing or eval so a crafted conf
# leak variables into our env, then validate the values we care # file cannot execute arbitrary shell as root.
# about. strip_conf_value() {
local v="$1"
case "$v" in
\"*\") v="${v:1:${#v}-2}" ;;
\'*\') v="${v:1:${#v}-2}" ;;
esac
printf '%s' "$v"
}
if [ -f "${CONF_FILE}" ]; then if [ -f "${CONF_FILE}" ]; then
echo "Found ${CONF_FILE}, attempting unattended enrollment." echo "Found ${CONF_FILE}, attempting unattended enrollment."
eval "$( CONF_SERVER=""
set -e CONF_TOKEN=""
# shellcheck source=/dev/null CONF_NOUPDATE=""
. "${CONF_FILE}" while IFS= read -r line || [ -n "$line" ]; do
printf 'CONF_SERVER=%q\n' "${PROBO_SERVER_URL:-}" line="${line%%#*}"
printf 'CONF_TOKEN=%q\n' "${PROBO_ENROLLMENT_TOKEN:-}" line="${line#"${line%%[![:space:]]*}"}"
printf 'CONF_NOUPDATE=%q\n' "${PROBO_NO_AUTO_UPDATE:-}" line="${line%"${line##*[![:space:]]}"}"
)" [ -z "$line" ] && continue
case "$line" in
PROBO_SERVER_URL=*)
CONF_SERVER="$(strip_conf_value "${line#PROBO_SERVER_URL=}")"
;;
PROBO_ENROLLMENT_TOKEN=*)
CONF_TOKEN="$(strip_conf_value "${line#PROBO_ENROLLMENT_TOKEN=}")"
;;
PROBO_NO_AUTO_UPDATE=*)
CONF_NOUPDATE="$(strip_conf_value "${line#PROBO_NO_AUTO_UPDATE=}")"
;;
esac
done < "${CONF_FILE}"
if [ -z "${CONF_SERVER}" ] || [ -z "${CONF_TOKEN}" ]; then if [ -z "${CONF_SERVER}" ] || [ -z "${CONF_TOKEN}" ]; then
echo "warning: ${CONF_FILE} is missing PROBO_SERVER_URL or PROBO_ENROLLMENT_TOKEN; skipping enrollment." echo "warning: ${CONF_FILE} is missing PROBO_SERVER_URL or PROBO_ENROLLMENT_TOKEN; skipping enrollment."