From fed7a2ba741c1f8d539b8c020c0b5d5c62bdc2be Mon Sep 17 00:00:00 2001
From: Jarrod Johnson <jjohnson2@lenovo.com>
Date: Wed, 7 Oct 2026 17:30:15 -0400
Subject: [PATCH] Change from a dynamically written askpass

/tmp can be hardened to noexec, /run is also sometimes noexeced.

However, we don't need a varying askpass, so just do one in a libexec directory.
o
---
 confluent_server/confluent/sshutil.py         | 12 +-----------
 confluent_server/libexec/confluent_askpass.sh |  2 ++
 confluent_server/setup.py.tmpl                |  1 +
 3 files changed, 4 insertions(+), 11 deletions(-)
 create mode 100644 confluent_server/libexec/confluent_askpass.sh

diff --git a/confluent_server/confluent/sshutil.py b/confluent_server/confluent/sshutil.py
index cce58b39..58c49a39 100644
--- a/confluent_server/confluent/sshutil.py
+++ b/confluent_server/confluent/sshutil.py
@@ -156,17 +156,7 @@ async def prep_ssh_key(keyname):
         adding_key = False
         return
     try:
-        os.makedirs('/run/confluent/ssh', mode=0o700)
-    except OSError as e:
-        if e.errno != 17:
-            raise
-    os.chmod('/run/confluent/ssh', 0o700)
-    tmpdir = tempfile.mkdtemp(dir='/run/confluent/ssh', prefix='askpass.')
-    try:
-        askpass = os.path.join(tmpdir, 'askpass.sh')
-        with open(askpass, 'w') as ap:
-            ap.write('#!/bin/sh\necho $CONFLUENT_SSH_PASSPHRASE\nrm {0}\n'.format(askpass))
-        os.chmod(askpass, 0o700)
+        askpass = '/opt/confluent/libexec/confluent_askpass.sh'
         os.environ['CONFLUENT_SSH_PASSPHRASE'] = await get_passphrase()
         olddisplay = os.environ.get('DISPLAY', None)
         oldaskpass = os.environ.get('SSH_ASKPASS', None)
diff --git a/confluent_server/libexec/confluent_askpass.sh b/confluent_server/libexec/confluent_askpass.sh
new file mode 100644
index 00000000..442f5841
--- /dev/null
+++ b/confluent_server/libexec/confluent_askpass.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo $CONFLUENT_SSH_PASSPHRASE
diff --git a/confluent_server/setup.py.tmpl b/confluent_server/setup.py.tmpl
index 154721fa..fc3994fa 100644
--- a/confluent_server/setup.py.tmpl
+++ b/confluent_server/setup.py.tmpl
@@ -41,6 +41,7 @@ setup(
     data_files=[('/usr/lib/sysctl.d', ['sysctl/confluent.conf']),
                 ('/opt/confluent/share/licenses/confluent_server', ['LICENSE', 'COPYRIGHT']),
                 ('/usr/lib/systemd/system', ['systemd/confluent.service']),
+		('/opt/confluent/libexec/confluent_askpass.sh', ['libexec/confluent_askpass.sh']),
 		('/opt/confluent/lib/python/confluent/plugins/console/', [])],
 
 )