Config sync should only sync icinga config files

[Mikesch-mp]

Describe the bug

Icinga still syncs every file, even it is not a `.conf`` from master to other master/satellites & agents if it inside a zone directory of the configuration master.

To Reproduce

1. Create a file or copy evil.sh to /etc/icinga2/zones.d/global-config
2. reload icinga2
3. check /var/lib/icinga2/api/zones/global-config/_etc

Expected behavior

Icinga2 should only sync files with .conf extension or even better .conf files that contains only valid configuration, otherwise you can have a lot of fun on a lot of host if you are evil like me

[Al2Klimov]

@N-o-X What's your opinion?

[N-o-X]

@Mikesch-mp is right, it's not necessary to sync every file. We explicitly say in our docs, that you should not use that mechanism for anything else. My only concern is to break stuff users have build with this "unintended feature".

[Al2Klimov]

Right, I've heard someone is even syncing check plugins. Not that I consider that good practice, but we shall not break anything.

[Mikesch-mp]

What do you break if it is written in the docs that trhere should only be config. To roll out plugins other stuff there are other tools like ansible. For me this is a big security hole, because i can sync scripts to agents, satellites etc that do real bad stuff that should not be possible.
Think about installations that monitors servers for other customers that think its only config that can be snyced and not scripts, binaries that can then be called by icinga creating a command/service configuration to execute them

[Al2Klimov]

I can also sync check commands that run bash -c ... by themselves w/o any additional script.

[Mikesch-mp]

Yeah but as customer you have it under control what the icinga deamon can run, if it is possible to put scripts and binaries without knowledge of the owner to the agents its a security risk

[Al2Klimov]

No, it's not.