Merge pull request #2370 from opscode/ryan/follow_symlinks

Make client.pem being a symlink a configurable option

3 files changed, 25 insertions, 1 deletions

diff --git a/lib/chef/api_client/registration.rb b/lib/chef/api_client/registration.rb
index 213d0b7f49..8a5885eff3 100644
--- a/lib/chef/api_client/registration.rb
+++ b/lib/chef/api_client/registration.rb
@@ -153,7 +153,9 @@ class Chef
       def file_flags
         base_flags = File::CREAT|File::TRUNC|File::RDWR
         # Windows doesn't have symlinks, so it doesn't have NOFOLLOW
-        base_flags |= File::NOFOLLOW if defined?(File::NOFOLLOW)
+        if defined?(File::NOFOLLOW) && !Chef::Config[:follow_client_key_symlink]
+          base_flags |= File::NOFOLLOW
+        end
         base_flags
       end
     end
diff --git a/lib/chef/config.rb b/lib/chef/config.rb
index 2dca41791f..d3871c38e8 100644
--- a/lib/chef/config.rb
+++ b/lib/chef/config.rb
@@ -396,6 +396,12 @@ class Chef
     # If chef-zero is enabled, this defaults to nil (no authentication).
     default(:client_key) { chef_zero.enabled ? nil : platform_specific_path("/etc/chef/client.pem") }
 
+    # When registering the client, should we allow the client key location to
+    # be a symlink?  eg: /etc/chef/client.pem -> /etc/chef/prod-client.pem
+    # If the path of the key goes through a directory like /tmp this should
+    # never be set to true or its possibly an easily exploitable security hole.
+    default :follow_client_key_symlink, false
+
     # This secret is used to decrypt encrypted data bag items.
     default(:encrypted_data_bag_secret) do
       if File.exist?(platform_specific_path("/etc/chef/encrypted_data_bag_secret"))
diff --git a/spec/unit/api_client/registration_spec.rb b/spec/unit/api_client/registration_spec.rb
index 55348ec8ee..2c7e1a854d 100644
--- a/spec/unit/api_client/registration_spec.rb
+++ b/spec/unit/api_client/registration_spec.rb
@@ -209,6 +209,22 @@ describe Chef::ApiClient::Registration do
       registration.write_key
       expect(IO.read(key_location)).to eq("--begin rsa key etc--")
     end
+
+    context 'when the client key location is a symlink' do
+      it 'does not follow the symlink', :unix_only do
+        expect(registration.file_flags).to eq(File::CREAT|File::TRUNC|File::RDWR|File::NOFOLLOW)
+      end
+
+      context 'with follow_client_key_symlink set to true' do
+        before do
+          Chef::Config[:follow_client_key_symlink] = true
+        end
+
+        it 'follows the symlink', :unix_only do
+          expect(registration.file_flags).to eq(File::CREAT|File::TRUNC|File::RDWR)
+        end
+      end
+    end
   end
 
   describe "when registering a client" do