{"record":{"id":"a8983c3c9fab15ec","repo":"puppetlabs/puppet","slug":"entry-line-chomp-is-unsupported-and-will-be-i","errorCode":null,"errorMessage":"Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}","messagePattern":"Entry '#(.+?)' is unsupported and will be ignored at #(.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/puppet/file_serving/configuration/parser.rb","lineNumber":42,"sourceCode":"        case line\n        when /^\\s*#/; next # skip comments\n        when /^\\s*$/; next # skip blank lines\n        when /\\[([-\\w]+)\\]/\n          mount = newmount(::Regexp.last_match(1))\n        when /^\\s*(\\w+)\\s+(.+?)(\\s*#.*)?$/\n          var = ::Regexp.last_match(1)\n          value = ::Regexp.last_match(2)\n          value.strip!\n          raise(ArgumentError, _(\"Fileserver configuration file does not use '=' as a separator\")) if value =~ /^=/\n\n          case var\n          when \"path\"\n            path(mount, value)\n          when \"allow\", \"deny\"\n            # ignore `allow *`, otherwise report error\n            if var != 'allow' || value != '*'\n              error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)\n              Puppet.err(\"Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}\")\n            end\n          else\n            error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)\n            raise ArgumentError, _(\"Invalid argument '%{var}' at %{error_location}\") %\n                                 { var: var, error_location: error_location_str }\n          end\n        else\n          error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)\n          raise ArgumentError, _(\"Invalid entry at %{error_location}: '%{file_text}'\") %\n                               { file_text: line.chomp, error_location: error_location_str }\n        end\n      end\n    end\n\n    validate\n\n    @mounts\n  end","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/file_serving/configuration/parser.rb#L24-L60","documentation":"Logged by the fileserver configuration parser: in fileserver.conf, allow/deny entries are no longer honored — only `allow *` is silently accepted, and any other allow/deny line is reported as unsupported and ignored. Mount ACLs moved to auth.conf / Puppet Server auth rules, so file-serving access control must live there; the ignored entry has no effect.","triggerScenarios":"A fileserver.conf containing e.g. `allow 10.0.0.0/8` or `deny evil.example.com` under a mount. The parser's case hits the allow/deny branch, and because it is not `allow *`, Puppet.err logs the entry with file/line and the entry is skipped.","commonSituations":"Configs carried forward from Puppet 3.x masters; operators assuming fileserver.conf still restricts file serving; hardening passes that add deny lines that silently do nothing.","solutions":["Delete allow/deny lines from fileserver.conf — keep only mount and path entries","Enforce access control in auth.conf or Puppet Server HOCON auth rules instead","Reload/restart the Puppet server after changing ACL files","Audit that no mount relied on the ignored deny line for security"],"exampleFix":"# before (fileserver.conf)\n[files]\n  path /etc/puppet/files\n  allow 10.0.0.0/8\n  deny badhost.example.com\n\n# after (fileserver.conf)\n[files]\n  path /etc/puppet/files\n\n# access rules live in auth.conf / Puppet Server auth rules","handlingStrategy":"validation","validationCode":"File.readlines('/etc/puppetlabs/puppet/fileserver.conf').each_with_index do |line, i|\n  if line =~ /^\\s*(allow|deny)\\b/i && line !~ /^\\s*allow\\s+\\*\\s*$/i\n    abort \"fileserver.conf:#{i + 1}: ACLs are unsupported — move rules to auth.conf\"\n  end\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep fileserver.conf to mounts and paths only; manage ACLs in auth.conf via a module","Lint Puppet config files in CI so allow/deny lines fail the build","Security-review any migrated fileserver.conf for silently ignored deny rules"],"tags":["ruby","puppet","fileserver","config","access-control","deprecated"],"backgroundTag":"unsupported-config-entry","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}