Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] chef-client hangs occasionally on Windows during writing or removing dd username or password using windows_env #935

Open
mwijers opened this issue Dec 20, 2024 · 0 comments

Comments

@mwijers
Copy link

mwijers commented Dec 20, 2024

In the Windows recipe _install-windows.rb the dd agent username and password is retrieved from encrypted databag, during the chef infra client run from task-scheduler in SYSTEM context.
The username and password is written to the environment variable using windows_env and removed at the end of the recipe.
This has 2 risks, 1 is the password is written in cleartext in the environment variables and if removal fails due to the hanging issue it stays stored (when ruby process is killed as chef-client will hang in a running state).

The issue happens when there is a race condition in access to windows_env which is locked by another process, there is no error handling in the recipe which results in hanging chef-client in the stage of this recipe during writing or removing the dd username or password in windows environment for SYSTEM.

Implementing a change to use node.run_state instead of windows_env prevents the issue from happening and makes sure the credentials aren't leaked because they aren't stored.

For this change I opened a PR on this recipe:
#934

Could you please take a look at this suggested improvement and solution PR?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant