Plugins » OpenSCAP

Description of problem:
Since path is usually set to /usr/bin, before /usr/sbin, when facter gathers facts about the RH certificate, userhelper is called in the background, resulting in (these) unnecessary calls + unnecessary log entries.

Version-Release number of selected component (if applicable): puppet-foreman_scap_client-0.3.19-1.el7sat.noarch

How reproducible: Always

Steps to Reproduce:
1. 'puppet agent -t' on host with puppet-foreman_scap_client applied
2. Check /var/log/secure; You should be able to see something like this:
Nov 26 10:57:12 ronda-adduci userhelper¹⁰²⁰⁴: pam_timestamp(subscription-manager:session): updated timestamp file `/var/run/sudo/root/unknown'
Nov 26 10:57:12 ronda-adduci userhelper¹⁰²⁰⁵: running '/usr/sbin/subscription-manager config' with root privileges on behalf of 'root'

Actual results:
See step 2 of reproducer.

Expected results:
No unnecessary calls to userhelper and log entries.

Additional info:
Simple patch - just call subscription manager with full path:

----------
--- /usr/share/puppet/modules/foreman_scap_client/lib/facter/rh_certificates.rb.191018-1 2016-08-09 08:13:14.000000000 0000
++ /usr/share/puppet/modules/foreman_scap_client/lib/facter/rh_certificates.rb 2019-10-18 11:59:26.497804176 0000
@ -3,7 +3,7 @
certificate_end_path = '/cert.pem'
private_key_end_path = '/key.pem'
rh_default_ca_cert = '/etc/rhsm/ca/redhat-uep.pem'
- data = Facter::Util::Resolution.exec('subscription-manager config')
data = Facter::Util::Resolution.exec('/usr/sbin/subscription-manager config')
return nil if data.nil? || data.empty?
data = data.gsub("\n", "").gsub(/[\[\]]/, "")
data_array = data.scan(/(\S+)\s*=\s* ([^ ]+)/)