[cobbler-devel] Power templates
After digging into issue #71 (No semicolon allowd in "--power-pass="),
I have come to the conclusion that all of this stuff should be
rewritten in a more sane manner. All of the fence_* commands accept
input on STDIN, so I believe we should take advantage of that fact and
rewrite these templates to feed the data into the subprocess that way
rather than via command line options.
My reasoning is this - trying to cover every corner case for escaping
variables being passed to the sub_process module is going to be error
prone, and could expose a security hole. The utils.safe_filter()
function doesn't even filter things - it just throws an error if it
detects something. Using the capability provided by the fence agents
is easier and safer, so we should use it. The downside is that it
would be somewhat invasive for people who rely on these templates -
existing installations would have to manually transition to the new
templates. Maybe that's not such a huge deal, since really I'd imagine
people are only using one or two of them.
Anyway, thoughts? Not all the templates (out of 13) need to be
updated, even. The virsh and ether_wake templates don't even use all
of the power_* variables, so it would be possible to wrap some safety
into those templates directly (like putting single quotes around
variables). Even that's not error proof, as we'd have to guard against
someone putting single or double quotes in their variables too, but we
may be limited by what those commands require. There is a fence_virsh,
maybe we should modify that template to use it as well?
I know we can only protect users against themselves so much, but I do
think this should be addressed in some better way, and I'm definitely
open to suggestions.