Merge pull request saltstack#461 from barbaricyawps/docs_3002.9

Add 3002.9 changelog, release notes, man pages
barneysowood · May 25, 2022 · e8fb2b4 · e8fb2b4
2 parents 37d8bb7 + 2634bb9
commit e8fb2b4
Show file tree

Hide file tree

Showing 21 changed files with 69 additions and 23 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,23 @@ Versions are `MAJOR.PATCH`.
 
 # Changelog
 
+Salt 3002.9 (2022-05-25)
+========================
+
+Fixed
+-----
+
+- Fixed an error when running on CentOS Stream 8. (#59161)
+- Fix bug in tcp transport (#61865)
+- Make sure the correct key is being used when verifying or validating communication, eg. when a Salt syndic is involved use syndic_master.pub and when a Salt minion is involved use minion_master.pub. (#61868)
+
+
+Security
+--------
+
+- Fixed PAM auth to reject auth attempt if user account is locked. (cve-2022-22967)
+
+
 Salt 3002.8 (2022-02-25)
 ========================
 

diff --git a/changelog/59161.fixed b/changelog/59161.fixed
diff --git a/changelog/61865.fixed b/changelog/61865.fixed
diff --git a/changelog/61868.fixed b/changelog/61868.fixed
diff --git a/changelog/cve-2022-22967.security b/changelog/cve-2022-22967.security
diff --git a/doc/man/salt-api.1 b/doc/man/salt-api.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-API" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-API" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-api \- salt-api Command
 .

diff --git a/doc/man/salt-call.1 b/doc/man/salt-call.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CALL" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-CALL" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-call \- salt-call Documentation
 .

diff --git a/doc/man/salt-cloud.1 b/doc/man/salt-cloud.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CLOUD" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-CLOUD" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-cloud \- Salt Cloud Command
 .

diff --git a/doc/man/salt-cp.1 b/doc/man/salt-cp.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CP" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-CP" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-cp \- salt-cp Documentation
 .

diff --git a/doc/man/salt-key.1 b/doc/man/salt-key.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-KEY" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-KEY" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-key \- salt-key Documentation
 .

diff --git a/doc/man/salt-master.1 b/doc/man/salt-master.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-MASTER" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-MASTER" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-master \- salt-master Documentation
 .

diff --git a/doc/man/salt-minion.1 b/doc/man/salt-minion.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-MINION" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-MINION" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-minion \- salt-minion Documentation
 .

diff --git a/doc/man/salt-proxy.1 b/doc/man/salt-proxy.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-PROXY" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-PROXY" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-proxy \- salt-proxy Documentation
 .

diff --git a/doc/man/salt-run.1 b/doc/man/salt-run.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-RUN" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-RUN" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-run \- salt-run Documentation
 .

diff --git a/doc/man/salt-ssh.1 b/doc/man/salt-ssh.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-SSH" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-SSH" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-ssh \- salt-ssh Documentation
 .

diff --git a/doc/man/salt-syndic.1 b/doc/man/salt-syndic.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-SYNDIC" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-SYNDIC" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-syndic \- salt-syndic Documentation
 .

diff --git a/doc/man/salt-unity.1 b/doc/man/salt-unity.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-UNITY" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT-UNITY" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt-unity \- salt-unity Command
 .

diff --git a/doc/man/salt.1 b/doc/man/salt.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt \- salt
 .

diff --git a/doc/man/salt.7 b/doc/man/salt.7
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT" "7" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SALT" "7" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 salt \- Salt Documentation
 .
@@ -88125,7 +88125,7 @@ beacons:
 .B salt.beacons.adb.validate(config)
 Validate the beacon configuration
 .UNINDENT
-.SS salt.beacons.aix_account module
+.SS salt.beacons.aix_account
 .sp
 Beacon to fire event when we notice a AIX user is locked due to many failed login attempts.
 .sp
@@ -191337,7 +191337,7 @@ Passes through all the parameters described in the
 \fI\%utils.http.query function\fP:
 .INDENT 7.0
 .TP
-.B salt.utils.http.query(url, method=\(aqGET\(aq, params=None, data=None, data_file=None, header_dict=None, header_list=None, header_file=None, username=None, password=None, auth=None, decode=False, decode_type=\(aqauto\(aq, status=False, headers=False, text=False, cookies=None, cookie_jar=None, cookie_format=\(aqlwp\(aq, persist_session=False, session_cookie_jar=None, data_render=False, data_renderer=None, header_render=False, header_renderer=None, template_dict=None, test=False, test_url=None, node=\(aqminion\(aq, port=80, opts=None, backend=None, ca_bundle=None, verify_ssl=None, cert=None, text_out=None, headers_out=None, decode_out=None, stream=False, streaming_callback=None, header_callback=None, handle=False, agent=\(aqSalt/3002.8\(aq, hide_fields=None, raise_error=True, formdata=False, formdata_fieldname=None, formdata_filename=None, decode_body=True, **kwargs)
+.B salt.utils.http.query(url, method=\(aqGET\(aq, params=None, data=None, data_file=None, header_dict=None, header_list=None, header_file=None, username=None, password=None, auth=None, decode=False, decode_type=\(aqauto\(aq, status=False, headers=False, text=False, cookies=None, cookie_jar=None, cookie_format=\(aqlwp\(aq, persist_session=False, session_cookie_jar=None, data_render=False, data_renderer=None, header_render=False, header_renderer=None, template_dict=None, test=False, test_url=None, node=\(aqminion\(aq, port=80, opts=None, backend=None, ca_bundle=None, verify_ssl=None, cert=None, text_out=None, headers_out=None, decode_out=None, stream=False, streaming_callback=None, header_callback=None, handle=False, agent=\(aqSalt/3002.9\(aq, hide_fields=None, raise_error=True, formdata=False, formdata_fieldname=None, formdata_filename=None, decode_body=True, **kwargs)
 Query a resource, and decode the return data
 .UNINDENT
 .INDENT 7.0
@@ -328643,8 +328643,8 @@ Alternate constructor that accept multiple recipients and rooms
 .B filter(record)
 Determine if the specified record is to be logged.
 .sp
-Returns True if the record should be logged, or False otherwise.
-If deemed appropriate, the record may be modified in\-place.
+Is the specified record to be logged? Returns 0 for no, nonzero for
+yes. If deemed appropriate, the record may be modified in\-place.
 .UNINDENT
 .UNINDENT
 .INDENT 0.0
@@ -455301,6 +455301,18 @@ Ensure that sourced file is cached using its hash name (cve\-2021\-21996)
 .SS Salt 3002.8 (2022\-02\-25)
 .sp
 Version 3002.8 is a CVE security fix release for 3002\&.
+.SS Important notice about upgrading
+.sp
+Version 3002.8 is a security release. 3002.8 minions are not able to
+communicate with masters older than 3002.8. You must upgrade your masters
+before upgrading minions.
+.SS Minion authentication security
+.sp
+Authentication between masters and minions rely on public/private key
+encryption and message signing. To secure minion authentication before you must
+pre\-seed the master\(aqs public key on minions. To pre\-seed the minions\(aq master
+key, place a copy of the master\(aqs public key in the minion\(aqs pki directory as
+\fBminion_master.pub\fP\&.
 .SS Security
 .INDENT 0.0
 .IP \(bu 2

diff --git a/doc/man/spm.1 b/doc/man/spm.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SPM" "1" "Feb 25, 2022" "3002.8" "Salt"
+.TH "SPM" "1" "May 25, 2022" "3002.9" "Salt"
 .SH NAME
 spm \- Salt Package Manager Command
 .

diff --git a/doc/topics/releases/3002.9.rst b/doc/topics/releases/3002.9.rst
@@ -0,0 +1,21 @@
+.. _release-3002-9:
+
+
+========================
+Salt 3002.9 (2022-05-25)
+========================
+
+Version 3002.9 is a CVE security fix release for :ref:`3002 <release-3002>`.
+
+Fixed
+-----
+
+- Fixed an error when running on CentOS Stream 8. (#59161)
+- Fix bug in tcp transport (#61865)
+- Make sure the correct key is being used when verifying or validating communication, eg. when a Salt syndic is involved use syndic_master.pub and when a Salt minion is involved use minion_master.pub. (#61868)
+
+
+Security
+--------
+
+- Fixed PAM auth to reject auth attempt if user account is locked. (cve-2022-22967)