Problem:
After updating to Foreman + Katello to 5.0, remote exec fails on all hosts that are installed with CIS 1 or CIS 2 compliance. Installing with CIS 1/2 is a supported installation option in Anaconda do harden systems. It now fails on affected hosts with:
1: Error initializing command: RuntimeError - Failed to execute script on remote machine, exit code: 126.
2: Exit status: EXCEPTION
3: StandardError: Job execution failed
Expected outcome:
Remote exec working like it did with previous versions of Foreman
Foreman and Proxy versions:
foreman-5.0.0-1.el9.noarch
foreman-proxy-5.0.0-1.el9.noarch
Foreman and Proxy plugin versions:
| foreman-tasks | The goal of this plugin is to unify the way of showing task statuses across the Foreman instance. It defines Task model for keeping the information about the tasks and Lock for assigning the tasks to resources. The locking allows dealing with preventing multiple colliding tasks to be run on the same resource. It also optionally provides Dynflow infrastructure for using it for managing the tasks. | Ivan Nečas | 13.2.0 |
|---|---|---|---|
| foreman_ansible | Ansible integration with Foreman | Daniel Lobato Garcia | 18.0.1 |
| foreman_azure_rm | This gem provides Azure Resource Manager as a compute resource for The Foreman | Aditi Puntambekar, Shimon Shtein, and Tyler Gregory | 3.0.4 |
| foreman_bootdisk | Plugin for Foreman that creates iPXE-based boot disks to provision hosts without the need for PXE infrastructure. | Dominic Cleal | 24.0.0 |
| foreman_fog_proxmox | Foreman plugin adds Proxmox VE compute resource using fog-proxmox. It is compatible with Foreman 1.22+ | Tristan Robert and The Foreman Team | 0.25.0 |
| foreman_remote_execution | A plugin bringing remote execution to the Foreman, completing the config management functionality with remote management functionality. | Foreman Remote Execution team | 17.2.1 |
| katello | Katello adds Content and Subscription Management to Foreman. For this it relies on Candlepin and Pulp. | N/A | 5.0.0 |
Distribution and version:
Alma Linux 8, 9 and 10.
Other relevant data:
Removing noexec on /var/tmp solve the issue, but allowing exec on /var/tmp or /tmp is not recommended in CIS 1 + CIS 2 to be compliant. In previous Foreman versions, execution didnt happen in /var/tmp but the remote exec user directory.
