[Bug]: syslog gem presence is used to determine POSIX

[ekohl]

Is this a critical security issue?

• This is not a security issue.

Describe the Bug

Puppet uses syslog to determine POSIX and Ruby 3.4 no longer ships syslog by default.

$ bundle exec puppet --help
/home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet/util/feature.rb:116: warning: syslog was loaded from the standard library, but is not part of the default gems starting from Ruby 3.4.0.
You can add syslog to your Gemfile or gemspec to silence this warning.
bundler: failed to load command: puppet (/home/ekohl/.local/share/gem/ruby/bin/puppet)
/home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet/feature/base.rb:21:in '<top (required)>': Cannot determine basic system flavour (Puppet::Error)
	from /home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet.rb:91:in 'Kernel#require_relative'
	from /home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet.rb:91:in '<module:Puppet>'
	from /home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet.rb:38:in '<top (required)>'
	from /home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet/util/command_line.rb:14:in 'Kernel#require_relative'
	from /home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/lib/puppet/util/command_line.rb:14:in '<top (required)>'
	from /usr/share/ruby/bundled_gems.rb:82:in 'Kernel.require'
	from /usr/share/ruby/bundled_gems.rb:82:in 'block (2 levels) in Kernel#replace_require'
	from /home/ekohl/.local/share/gem/ruby/gems/openvox-8.19.0/bin/puppet:5:in '<top (required)>'
	from /home/ekohl/.local/share/gem/ruby/bin/puppet:25:in 'Kernel#load'
	from /home/ekohl/.local/share/gem/ruby/bin/puppet:25:in '<top (required)>'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/cli/exec.rb:59:in 'Kernel.load'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/cli/exec.rb:59:in 'Bundler::CLI::Exec#kernel_load'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/cli/exec.rb:23:in 'Bundler::CLI::Exec#run'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/cli.rb:452:in 'Bundler::CLI#exec'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/vendor/thor/lib/thor/command.rb:28:in 'Bundler::Thor::Command#run'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/vendor/thor/lib/thor/invocation.rb:127:in 'Bundler::Thor::Invocation#invoke_command'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/vendor/thor/lib/thor.rb:538:in 'Bundler::Thor.dispatch'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/cli.rb:35:in 'Bundler::CLI.dispatch'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/vendor/thor/lib/thor/base.rb:584:in 'Bundler::Thor::Base::ClassMethods#start'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/cli.rb:29:in 'Bundler::CLI.start'
	from /usr/share/gems/gems/bundler-2.6.2/exe/bundle:28:in 'block in <top (required)>'
	from /usr/share/gems/gems/bundler-2.6.2/lib/bundler/friendly_errors.rb:117:in 'Bundler.with_friendly_errors'
	from /usr/share/gems/gems/bundler-2.6.2/exe/bundle:20:in '<top (required)>'
	from /home/ekohl/bin/bundle:25:in 'Kernel#load'
	from /home/ekohl/bin/bundle:25:in '<main>'

Expected Behavior

Puppet help shows

Steps to Reproduce

mkdir reproducer
cd reproducer
bundle init
bundle add openvox
bundle add racc # https://github.com/OpenVoxProject/puppet/pull/89
bundle exec puppet --help

Environment

Ruby 3.4

Additional Context

Relevant code:

puppet/lib/puppet/feature/base.rb

Lines 9 to 21 in f5289a1

	# We have a syslog implementation
	Puppet.features.add(:syslog, :libs => ["syslog"])
	# We can use POSIX user functions
	Puppet.features.add(:posix) do
	require 'etc'
	!Etc.getpwuid(0).nil? && Puppet.features.syslog?
	end
	# We can use Microsoft Windows functions
	Puppet.features.add(:microsoft_windows) { Puppet::Util::Platform.windows? }
	raise Puppet::Error, _("Cannot determine basic system flavour") unless Puppet.features.posix? or Puppet.features.microsoft_windows?

And Ruby 3.4 made syslog a bundled gem instead of a default gem. This means you need to specify it in your gemspec or every consumer needs to specify it in their Gemfile. See https://stdgems.org/syslog/

Relevant log output

[jstraw]

It looks like getconf can request posix version:

$ getconf POSIX2_VERSION
200809

It also has a list of other posix related flags (that may be useful)

_POSIX_LINK_MAX                    2147483647
_POSIX_MAX_CANON                   255
_POSIX_MAX_INPUT                   255
_POSIX_NAME_MAX                    255
_POSIX_PATH_MAX                    4096
_POSIX_PIPE_BUF                    4096
_POSIX_ASYNC_IO                    
_POSIX_CHOWN_RESTRICTED            1
_POSIX_NO_TRUNC                    1
_POSIX_PRIO_IO                     
_POSIX_SYNC_IO                     
_POSIX_VDISABLE                    0
_POSIX_ARG_MAX                     2097152
_POSIX_ASYNCHRONOUS_IO             200809
_POSIX_CHILD_MAX                   127613
_POSIX_FSYNC                       200809
_POSIX_JOB_CONTROL                 1
_POSIX_MAPPED_FILES                200809
_POSIX_MEMLOCK                     200809
_POSIX_MEMLOCK_RANGE               200809
_POSIX_MEMORY_PROTECTION           200809
_POSIX_MESSAGE_PASSING             200809
_POSIX_NGROUPS_MAX                 65536
_POSIX_OPEN_MAX                    1024
_POSIX_PII                         
_POSIX_PII_INTERNET                
_POSIX_PII_INTERNET_DGRAM          
_POSIX_PII_INTERNET_STREAM         
_POSIX_PII_OSI                     
_POSIX_PII_OSI_CLTS                
_POSIX_PII_OSI_COTS                
_POSIX_PII_OSI_M                   
_POSIX_PII_SOCKET                  
_POSIX_PII_XTI                     
_POSIX_POLL                        
_POSIX_PRIORITIZED_IO              200809
_POSIX_PRIORITY_SCHEDULING         200809
_POSIX_REALTIME_SIGNALS            200809
_POSIX_SAVED_IDS                   1
_POSIX_SELECT                      
_POSIX_SEMAPHORES                  200809
_POSIX_SHARED_MEMORY_OBJECTS       200809
_POSIX_SSIZE_MAX                   32767
_POSIX_STREAM_MAX                  16
_POSIX_SYNCHRONIZED_IO             200809
_POSIX_THREADS                     200809
_POSIX_THREAD_ATTR_STACKADDR       200809
_POSIX_THREAD_ATTR_STACKSIZE       200809
_POSIX_THREAD_PRIORITY_SCHEDULING  200809
_POSIX_THREAD_PRIO_INHERIT         200809
_POSIX_THREAD_PRIO_PROTECT         200809
_POSIX_THREAD_ROBUST_PRIO_INHERIT  
_POSIX_THREAD_ROBUST_PRIO_PROTECT  
_POSIX_THREAD_PROCESS_SHARED       200809
_POSIX_THREAD_SAFE_FUNCTIONS       200809
_POSIX_TIMERS                      200809
_POSIX_TZNAME_MAX                  
_POSIX_VERSION                     200809
POSIX2_BC_BASE_MAX                 99
POSIX2_BC_DIM_MAX                  2048
POSIX2_BC_SCALE_MAX                99
POSIX2_BC_STRING_MAX               1000
POSIX2_CHAR_TERM                   200809
POSIX2_COLL_WEIGHTS_MAX            255
POSIX2_C_BIND                      200809
POSIX2_C_DEV                       200809
POSIX2_C_VERSION                   200809
POSIX2_EXPR_NEST_MAX               32
POSIX2_FORT_DEV                    
POSIX2_FORT_RUN                    
_POSIX2_LINE_MAX                   2048
POSIX2_LINE_MAX                    2048
POSIX2_LOCALEDEF                   200809
POSIX2_RE_DUP_MAX                  32767
POSIX2_SW_DEV                      200809
POSIX2_UPE                         
POSIX2_VERSION                     200809
_POSIX_V6_ILP32_OFF32              
POSIX_V6_ILP32_OFF32_CFLAGS        
POSIX_V6_ILP32_OFF32_LDFLAGS       
POSIX_V6_ILP32_OFF32_LIBS          
POSIX_V6_ILP32_OFF32_LINTFLAGS     
_POSIX_V6_WIDTH_RESTRICTED_ENVS    POSIX_V6_LP64_OFF64
POSIX_V6_WIDTH_RESTRICTED_ENVS     POSIX_V6_LP64_OFF64
_POSIX_V6_ILP32_OFFBIG             
POSIX_V6_ILP32_OFFBIG_CFLAGS       
POSIX_V6_ILP32_OFFBIG_LDFLAGS      
POSIX_V6_ILP32_OFFBIG_LIBS         
POSIX_V6_ILP32_OFFBIG_LINTFLAGS    
_POSIX_V6_LP64_OFF64               1
POSIX_V6_LP64_OFF64_CFLAGS         -m64
POSIX_V6_LP64_OFF64_LDFLAGS        -m64
POSIX_V6_LP64_OFF64_LIBS           
POSIX_V6_LP64_OFF64_LINTFLAGS      
_POSIX_V6_LPBIG_OFFBIG             
POSIX_V6_LPBIG_OFFBIG_CFLAGS       
POSIX_V6_LPBIG_OFFBIG_LDFLAGS      
POSIX_V6_LPBIG_OFFBIG_LIBS         
POSIX_V6_LPBIG_OFFBIG_LINTFLAGS    
_POSIX_V7_ILP32_OFF32              
POSIX_V7_ILP32_OFF32_CFLAGS        
POSIX_V7_ILP32_OFF32_LDFLAGS       
POSIX_V7_ILP32_OFF32_LIBS          
POSIX_V7_ILP32_OFF32_LINTFLAGS     
_POSIX_V7_WIDTH_RESTRICTED_ENVS    POSIX_V7_LP64_OFF64
POSIX_V7_WIDTH_RESTRICTED_ENVS     POSIX_V7_LP64_OFF64
_POSIX_V7_ILP32_OFFBIG             
POSIX_V7_ILP32_OFFBIG_CFLAGS       
POSIX_V7_ILP32_OFFBIG_LDFLAGS      
POSIX_V7_ILP32_OFFBIG_LIBS         
POSIX_V7_ILP32_OFFBIG_LINTFLAGS    
_POSIX_V7_LP64_OFF64               1
POSIX_V7_LP64_OFF64_CFLAGS         -m64
POSIX_V7_LP64_OFF64_LDFLAGS        -m64
POSIX_V7_LP64_OFF64_LIBS           
POSIX_V7_LP64_OFF64_LINTFLAGS      
_POSIX_V7_LPBIG_OFFBIG             
POSIX_V7_LPBIG_OFFBIG_CFLAGS       
POSIX_V7_LPBIG_OFFBIG_LDFLAGS      
POSIX_V7_LPBIG_OFFBIG_LIBS         
POSIX_V7_LPBIG_OFFBIG_LINTFLAGS    
_POSIX_ADVISORY_INFO               200809
_POSIX_BARRIERS                    200809
_POSIX_BASE                        
_POSIX_C_LANG_SUPPORT              
_POSIX_C_LANG_SUPPORT_R            
_POSIX_CLOCK_SELECTION             200809
_POSIX_CPUTIME                     200809
_POSIX_THREAD_CPUTIME              200809
_POSIX_DEVICE_SPECIFIC             
_POSIX_DEVICE_SPECIFIC_R           
_POSIX_FD_MGMT                     
_POSIX_FIFO                        
_POSIX_PIPE                        
_POSIX_FILE_ATTRIBUTES             
_POSIX_FILE_LOCKING                
_POSIX_FILE_SYSTEM                 
_POSIX_MONOTONIC_CLOCK             200809
_POSIX_MULTI_PROCESS               
_POSIX_SINGLE_PROCESS              
_POSIX_NETWORKING                  
_POSIX_READER_WRITER_LOCKS         200809
_POSIX_SPIN_LOCKS                  200809
_POSIX_REGEXP                      1
_POSIX_SHELL                       1
_POSIX_SIGNALS                     
_POSIX_SPAWN                       200809
_POSIX_SPORADIC_SERVER             
_POSIX_THREAD_SPORADIC_SERVER      
_POSIX_SYSTEM_DATABASE             
_POSIX_SYSTEM_DATABASE_R           
_POSIX_TIMEOUTS                    200809
_POSIX_TYPED_MEMORY_OBJECTS        
_POSIX_USER_GROUPS                 
_POSIX_USER_GROUPS_R               
POSIX2_PBS                         
POSIX2_PBS_ACCOUNTING              
POSIX2_PBS_LOCATE                  
POSIX2_PBS_TRACK                   
POSIX2_PBS_MESSAGE                 
_POSIX_DEVICE_IO                   
_POSIX_TRACE                       
_POSIX_TRACE_EVENT_FILTER          
_POSIX_TRACE_INHERIT               
_POSIX_TRACE_LOG                   
POSIX_ALLOC_SIZE_MIN               4096
POSIX_REC_INCR_XFER_SIZE           
POSIX_REC_MAX_XFER_SIZE            
POSIX_REC_MIN_XFER_SIZE            4096
POSIX_REC_XFER_ALIGN               4096
POSIX2_SYMLINKS                    1
_POSIX_IPV6                        200809
_POSIX_RAW_SOCKETS                 200809

[smortex]

It looks like getconf can request posix version:

$ getconf POSIX2_VERSION
200809

Not sure how portable this is. On my system I get:

romain@zappy ~ % uname -a
FreeBSD zappy.blogreen.org 14.2-RELEASE-p1 FreeBSD 14.2-RELEASE-p1 GENERIC amd64
romain@zappy ~ % getconf POSIX2_VERSION   
getconf: no such configuration parameter `POSIX2_VERSION'
romain@zappy ~ (64) % getconf _POSIX2_VERSION
199212
romain@zappy ~ % getconf _POSIX_VERSION 
200112

Also the man page says

If a variable is undefined, the string “undefined” is output.

That looks like a fail 🤦

According to ruby/syslog#7, we can probably add syslog as a runtime dependency, and try to load it when we check the platform (just as we do with 'etc').

[jstraw]

Can we check _POSIX_VERSION on more platforms, I see it in the output from my linux system (I posted all of the available POSIX getconf values.

[ekohl]

I like what @smortex said. Looks like we can just depend on the gem unconditionally and it still raises a LoadError on Windows. That makes it way easier than I feared.

[ekohl]

This is still an issue because the JRuby situation is different. We'll run into that with the server component. Sadly ruby/syslog#1 is still open.

My proposal is to revert 6fcc677 and add it via Gemfile for now. It implies that all consumers need to do the same thing, which is awkward but needed for Ruby 3.4 support.