diff options
author | Ryan Cragun <me@ryan.ec> | 2014-11-06 15:47:36 -0800 |
---|---|---|
committer | Serdar Sutay <serdar@opscode.com> | 2014-11-07 17:22:32 -0800 |
commit | ccf7974905b6f6dce1e626f2894970813177445f (patch) | |
tree | a45d01acf9e0fb11dafbf6523019e785e2c48932 /lib/chef/config.rb | |
parent | 347b1d56a2784fc704e77dec2f1574ba61083f40 (diff) | |
download | chef-ccf7974905b6f6dce1e626f2894970813177445f.tar.gz |
Make client.pem being a symlink a configurable option
Diffstat (limited to 'lib/chef/config.rb')
-rw-r--r-- | lib/chef/config.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/chef/config.rb b/lib/chef/config.rb index 2dca41791f..d3871c38e8 100644 --- a/lib/chef/config.rb +++ b/lib/chef/config.rb @@ -396,6 +396,12 @@ class Chef # If chef-zero is enabled, this defaults to nil (no authentication). default(:client_key) { chef_zero.enabled ? nil : platform_specific_path("/etc/chef/client.pem") } + # When registering the client, should we allow the client key location to + # be a symlink? eg: /etc/chef/client.pem -> /etc/chef/prod-client.pem + # If the path of the key goes through a directory like /tmp this should + # never be set to true or its possibly an easily exploitable security hole. + default :follow_client_key_symlink, false + # This secret is used to decrypt encrypted data bag items. default(:encrypted_data_bag_secret) do if File.exist?(platform_specific_path("/etc/chef/encrypted_data_bag_secret")) |