This only converts the places in the utils package that were
logging with logrus, but it does not fully remove the logrus
package as a dependency. The package is home to the logrus text
formatter which needs to exist until slog is the only logging
mechanism in use.
* Fix TestReadEnvironmentFile on macOS
This test writes sample data to a temporary file and then tries to
parse it. In #34177 we disallowed reading the environment file from
a symlink, but the Go utilities we use to create temp files end up
using symlinks on macOS.
Fix this by breaking out the core functionality such that it only
requires an io.Reader instead of an os.File.
* Use consistent language in log output
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Better control on user injected environment values
This commit includes two changes:
* In `environment` we expanded the list of MacOS environment values which should be filtered. It was demonstrated that these can be used to get code execution in MacOS.
* In `reexec` we no longer provide the cmdmsg.Environment for the `teleport exec`. As part of the development of a9055bccd9 it was attempted to fully clear out the environment, but testing showed that to be potentially problematic. It was believed the safest option was to use the cmd environment, however this introduces a new source of environment variables. Because this exec happens under `root` this is particularly dangerous (even more so when combined with the missed OSX values mentioned above). As such we now are only providing the filtered exec environment, which is a closer (but safer) option to the functionality prior to a9055bccd9.
* Update filter to exclude all DYLD_ and LD_ prefixed variables
* Prevent `.tsh/environment` values from overloading prior set values
It's not possible to have duplicate environment values within an environment. And in fact the last value in the string slice will be preserved. Prior to this change that allows users to possibly change any environment values through the use of the `.tsh/environment` file. This is within user level control, where other environment value sources originate from a more protected location (for example the PAM configuration).
Prior to this change that allows users to possibly change any environment passed configuration through the use of the `.tsh/environment` file.
This change makes it so that the administrative set values will be preferred, and any duplicate records will be ignored.
* Apply PR feedback
* Only exclude duplicate environment values sourced from .tsh/environment
This change updates `SafeEnv` to be allow the caller to select if the value should be checked for duplicates.
We then leverage this to avoid this check when sourced from a trusted source. But then exclude potential duplicates when sourced from .tsh/environment file or the local environment.
* Filter dangerous environment variables before reexec
This change filters potentially dangerous environment variables that could result in code execution.
This seemed safest to integrate as a new struct within the `environment.go` in utils. This struct allows us to validate variables as they are built, making sure that regardless of the source we have validated them against our filter list.
The environment specific logic was significant enough that the current and new logic was refactored into a new package `envutils`.
* Allow the easy addition of execution environment into SafeEnv
In addition this commit adds in a check to look for duplicate keys which may be attempting to overload our set values.
* Apply PR Feedback and remove env duplicate handling
* Apply additional PR feedback
