Change from a dynamically written askpass

/tmp can be hardened to noexec, /run is also sometimes noexeced.

However, we don't need a varying askpass, so just do one in a libexec directory.
o

confluent_server/confluent/sshutil.py

@@ -156,17 +156,7 @@ async def prep_ssh_key(keyname):
         adding_key = False
         return
     try:
-        os.makedirs('/run/confluent/ssh', mode=0o700)
-    except OSError as e:
-        if e.errno != 17:
-            raise
-    os.chmod('/run/confluent/ssh', 0o700)
-    tmpdir = tempfile.mkdtemp(dir='/run/confluent/ssh', prefix='askpass.')
-    try:
-        askpass = os.path.join(tmpdir, 'askpass.sh')
-        with open(askpass, 'w') as ap:
-            ap.write('#!/bin/sh\necho $CONFLUENT_SSH_PASSPHRASE\nrm {0}\n'.format(askpass))
-        os.chmod(askpass, 0o700)
+        askpass = '/opt/confluent/libexec/confluent_askpass.sh'
         os.environ['CONFLUENT_SSH_PASSPHRASE'] = await get_passphrase()
         olddisplay = os.environ.get('DISPLAY', None)
         oldaskpass = os.environ.get('SSH_ASKPASS', None)

confluent_server/libexec/confluent_askpass.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo $CONFLUENT_SSH_PASSPHRASE

confluent_server/setup.py.tmpl

@@ -41,6 +41,7 @@ setup(
     data_files=[('/usr/lib/sysctl.d', ['sysctl/confluent.conf']),
                 ('/opt/confluent/share/licenses/confluent_server', ['LICENSE', 'COPYRIGHT']),
                 ('/usr/lib/systemd/system', ['systemd/confluent.service']),
+		('/opt/confluent/libexec/confluent_askpass.sh', ['libexec/confluent_askpass.sh']),
 		('/opt/confluent/lib/python/confluent/plugins/console/', [])],
 
 )