summaryrefslogtreecommitdiff
path: root/lib/chef/config.rb
diff options
context:
space:
mode:
Diffstat (limited to 'lib/chef/config.rb')
-rw-r--r--lib/chef/config.rb6
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/chef/config.rb b/lib/chef/config.rb
index 2dca41791f..d3871c38e8 100644
--- a/lib/chef/config.rb
+++ b/lib/chef/config.rb
@@ -396,6 +396,12 @@ class Chef
# If chef-zero is enabled, this defaults to nil (no authentication).
default(:client_key) { chef_zero.enabled ? nil : platform_specific_path("/etc/chef/client.pem") }
+ # When registering the client, should we allow the client key location to
+ # be a symlink? eg: /etc/chef/client.pem -> /etc/chef/prod-client.pem
+ # If the path of the key goes through a directory like /tmp this should
+ # never be set to true or its possibly an easily exploitable security hole.
+ default :follow_client_key_symlink, false
+
# This secret is used to decrypt encrypted data bag items.
default(:encrypted_data_bag_secret) do
if File.exist?(platform_specific_path("/etc/chef/encrypted_data_bag_secret"))