Saltstack: is it possible to forbid certain commands when using cmd.run?

Question

Let's say I have a salt-master and decide to run some arbitrary command in all my minions. But because I had a bad night, I was robbed on my way to work, my boss yelled at me for being late and my co-workers decided to play on me that nasty joke with pins and needles, instead of doing a harmless:

salt '*' cmd.run "rm -rf /var/tmp/some/directory/with/redundant/data"

What comes out is:

salt '*' cmd.run "rm -rf /"

Disaster! Is there any way that I can "blacklist" certain commands so they can't be executed using cmd.run?

Thanks in advance.

Not really. But the only answer is probably right, so I'll mark the question as answered. — rsuarez, Feb 02 '15 at 08:06

score 2 · Accepted Answer · answered Dec 05 '13 at 21:24

2

No. Not without customizing the source code.

answered Dec 05 '13 at 21:24

Dan Garthwaite

2,922
18
29

@slm I believe it does. He didn't ask howto, he asked if it was possible. Should I still delete this answer and use the comments? – Dan Garthwaite Dec 05 '13 at 22:51
@slm This answers the question just fine. Sometimes "No" is the answer. – ceejayoz Dec 05 '13 at 22:55
No leave it, I missed that he didn't want to know how. Sorry about that. – slm Dec 05 '13 at 22:58

Saltstack: is it possible to forbid certain commands when using cmd.run?

1 Answers1