Add {Allow,Deny}Key options
MODIFY
README.md
README.md
@@ -459,6 +459,8 @@ There are some more zabbix specific parameters, please check them by opening the
### Reference zabbix-agent
* `server`: This is the ipaddress of the zabbix-server or zabbix-proxy.
+* `allowkey`: Allows execution of item keys matching pattern.
+* `denykey`: Deny execution of items keys matching pattern.
* `tlsaccept`: What incoming connections to accept from Zabbix server. Used for a passive proxy, ignored on an active proxy.
* `tlscafile`: Full pathname of a file containing the top-level CA(s) certificates for peer certificate verification.
* `tlscertfile`: Full pathname of a file containing the proxy certificate or certificate chain.

MODIFY
manifests/agent.pp
manifests/agent.pp
# [*sourceip*]
# Source ip address for outgoing connections.
#
+# [*allowkey*]
+# Allow execution of item keys matching pattern.
+#
+# [*denykey*]
+# Deny execution of items keys matching pattern.
+#
# [*enableremotecommands*]
# Whether remote commands from zabbix server are allowed.
#
@@ -271,6 +277,8 @@ class zabbix::agent (
$logfilesize = $zabbix::params::agent_logfilesize,
$debuglevel = $zabbix::params::agent_debuglevel,
$sourceip = $zabbix::params::agent_sourceip,
+ Optional[String[1]] $allowkey = $zabbix::params::agent_allowkey,
+ Optional[String[1]] $denykey = $zabbix::params::agent_denykey,
$enableremotecommands = $zabbix::params::agent_enableremotecommands,
$logremotecommands = $zabbix::params::agent_logremotecommands,
$server = $zabbix::params::agent_server,

MODIFY
manifests/params.pp
manifests/params.pp
@@ -290,6 +290,8 @@ class zabbix::params {
$agent_buffersend = '5'
$agent_buffersize = '100'
$agent_debuglevel = '3'
+ $agent_allowkey = undef
+ $agent_denykey = 'system.run[*]'
$agent_enableremotecommands = '0'
$agent_hostmetadata = undef
$agent_hostmetadataitem = undef

MODIFY
spec/classes/agent_spec.rb
spec/classes/agent_spec.rb
@@ -260,6 +260,8 @@ describe 'zabbix::agent' do
buffersend: '5',
buffersize: '100',
debuglevel: '4',
+ allowkey: 'system.run[*]',
+ denykey: 'system.run[*]',
enableremotecommands: '1',
hostname: '10050',
include_dir: '/etc/zabbix/zabbix_agentd.d',
@@ -294,6 +296,8 @@ describe 'zabbix::agent' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^BufferSend=5$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^BufferSize=100$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^DebugLevel=4$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^AllowKey=system.run\[\*\]$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^DenyKey=system.run\[\*\]$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^Hostname=10050$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^Include=/etc/zabbix/zabbix_agentd.d$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^ListenPort=10050$} }

MODIFY
templates/zabbix_agentd.conf.erb
templates/zabbix_agentd.conf.erb
@@ -48,6 +48,32 @@ DebugLevel=<%= @debuglevel %>
#
<% if @sourceip %>SourceIP=<%= @sourceip %><% end %>
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: AllowKey
+# Allow execution of item keys matching pattern.
+# Multiple keys matching rules may be defined in combination with DenyKey.
+# Key pattern is wildcard expression, which support "*" character to match any number of any characters in certain position.
+# It might be used in both key name and key arguments.
+# Parameters are processed one by one according their appearance order.
+# If no AllowKey or DenyKey rules defined, all keys are allowed.
+#
+# Mandatory: no
+<% if @allowkey %>AllowKey=<%= @allowkey -%><% end %>
+
+### Option: DenyKey
+# Deny execution of items keys matching pattern.
+# Multiple keys matching rules may be defined in combination with AllowKey.
+# Key pattern is wildcard expression, which support "*" character to match any number of any characters in certain position.
+# It might be used in both key name and key arguments.
+# Parameters are processed one by one according their appearance order.
+# If no AllowKey or DenyKey rules defined, all keys are allowed.
+# Unless another system.run[*] rule is specified DenyKey=system.run[*] is added by default.
+#
+# Mandatory: no
+# Default:
+<% if @denykey %>DenyKey=<%= @denykey -%><% end %>
+<% end %>
+
<% if @zabbix_version.to_f < 5.0 %>
### Option: EnableRemoteCommands
# Whether remote commands from Zabbix server are allowed.

Add {Allow,Deny}Key options

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>