CFE-1982: Made an unrecognized action_policy fatal instead of defaulting to fix - #6275
Open
nickanderson wants to merge 1 commit into
Open
CFE-1982: Made an unrecognized action_policy fatal instead of defaulting to fix#6275nickanderson wants to merge 1 commit into
nickanderson wants to merge 1 commit into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The parser only checks the option list for literal values, so a value that arrives through a variable reaches the runtime unchecked. It was silently treated as 'fix', which means a typo like action_policy => "$(warn_only)" made changes on a host where the policy asked only to warn. A literal typo is already fatal at policy check time, so the expanded case now behaves the same way instead of guessing. Ticket: CFE-1982 Changelog: Title
Member
Author
|
@larsewi Seems that custom promise types are similarly affected, should I do separate for mod_custom.c or roll it into this one? |
nickanderson
force-pushed
the
CFE-1982/master
branch
from
August 5, 2026 21:37
0b3f5c0 to
500c949
Compare
nickanderson
changed the title
nickanderson
changed the title
larsewi
approved these changes
Aug 6, 2026
Member
Author
|
jenkins, please |
7 similar comments
Member
Author
|
jenkins, please |
Member
Author
|
jenkins, please |
Member
Author
|
jenkins, please |
Member
Author
|
jenkins, please |
Member
Author
|
jenkins, please |
Member
Author
|
jenkins, please |
Member
Author
|
jenkins, please |
Member
Author
|
@cf-bottom jenkins, please |
|
Sure, I triggered a build: Jenkins: https://ci.cfengine.com/job/pr-pipeline/14406/ Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14406/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An
action_policyvalue that arrives through a variable skips the parser'soption-list check and was silently treated as
fix, so a typo made changes on ahost where the policy asked only to warn. It is now a fatal error, which is what
a literal typo already does at policy check time.
Verified in both directions: with the fix the agent aborts and the promise is not
actuated, and with the fix reverted the report is emitted as before.