Avoid executing commands from path

client/tools/mgr-push/mgr-push.changes.mackdk.avoid-executing-commands-from-PATH

@@ -0,0 +1 @@
+- Use absolute paths when invoking external commands

client/tools/mgr-push/rhnpush_config.py

@@ -38,11 +38,11 @@ class rhnpushConfigParser:
     _instance = None
 
     def get_ca_bundle_path(self):
-        if os.system("grep -iq '^ID_LIKE=.*suse' /etc/os-release") == 0:
+        if os.system("/usr/bin/grep -iq '^ID_LIKE=.*suse' /etc/os-release") == 0:
             return '/etc/ssl/ca-bundle.pem'
-        if os.system("grep -iq '^ID_LIKE=.*rhel' /etc/os-release") == 0:
+        if os.system("/usr/bin/grep -iq '^ID_LIKE=.*rhel' /etc/os-release") == 0:
             return '/etc/pki/tls/certs/ca-bundle.crt'
-        if os.system("grep -iq '^ID_LIKE=.*debian' /etc/os-release") == 0:
+        if os.system("/usr/bin/grep -iq '^ID_LIKE=.*debian' /etc/os-release") == 0:
             return '/etc/ssl/certs/ca-certificates.crt'
 
     def __init__(self, filename=None, ensure_consistency=False):

java/code/src/com/redhat/rhn/domain/notification/types/UpdateAvailable.java

@@ -58,14 +58,17 @@ public boolean updateAvailable() {
 
         try {
             Process patchProc = runtime.exec(new String[]{"/bin/bash", "-c",
-                    "LC_ALL=C zypper lp -r " + repo + " | grep 'applicable patch'"});
+                    "LC_ALL=C /usr/bin/zypper lp -r " + repo + " | /usr/bin/grep 'applicable patch'"});
             patchProc.waitFor();
             // 0 here means there are patches
             hasUpdates = (0 == patchProc.exitValue());
             if (!hasUpdates && !mgr) {
                 // Check for updates on uyuni when there are no patches
-                Process updateProc = runtime.exec(new String[]{"/bin/bash", "-c",
-                        "LC_ALL=C zypper lu -r " + UYUNI_UPDATE_REPO + " | grep 'Available Version'"});
+                Process updateProc = runtime.exec(new String[]{
+                    "/bin/bash",
+                    "-c",
+                    "LC_ALL=C /usr/bin/zypper lu -r " + UYUNI_UPDATE_REPO + " | /usr/bin/grep 'Available Version'"
+                });
                 updateProc.waitFor();
                 hasUpdates = (0 == updateProc.exitValue());
             }

java/code/src/com/redhat/rhn/frontend/action/channel/manage/SyncRepositoriesAction.java

@@ -195,7 +195,7 @@ private boolean isSyncInProgress(Channel chan) {
         }
 
         // Is this PID running?
-        String[] cmd = {"ps", "-o", "args", "-p", pid};
+        String[] cmd = {"/usr/bin/ps", "-o", "args", "-p", pid};
         SystemCommandExecutor ce = new SystemCommandExecutor();
         ce.execute(cmd);
         return ce.getLastCommandOutput().contains(" " + chan.getLabel() + " ");

java/code/src/com/redhat/rhn/frontend/xmlrpc/system/SystemHandler.java

@@ -5910,8 +5910,7 @@ public Map transitionDataForSystem(String clientCert) throws FileNotFoundExcepti
                             map.put(csvUuid, record[uuidPos]);
                             map.put(csvSystemId, record[systemIdPos]);
                             map.put(csvStamp, fileStamp);
-                            String[] cmd = {"rpm", "--qf=%{NAME}",
-                                    "-qf", file.getAbsolutePath()};
+                            String[] cmd = {"/usr/bin/rpm", "--qf=%{NAME}", "-qf", file.getAbsolutePath()};
                             map.remove(csvHostname);
                             SystemCommandExecutor ce = new SystemCommandExecutor();
                             if (ce.execute(cmd) == 0) {

java/code/src/com/redhat/rhn/manager/rhnpackage/PackageManager.java

@@ -1808,7 +1808,7 @@ public static String getPackageChangeLog(Package pkg) {
         }
 
         List<String> cmd = new ArrayList<>();
-        cmd.add(Config.get().getString("rpm.path", "/bin/rpm"));
+        cmd.add("/usr/bin/rpm");
         cmd.add("-qp");
         cmd.add("--changelog");
         cmd.add(f.getPath());

java/code/src/com/redhat/rhn/taskomatic/task/payg/PaygAuthDataExtractor.java

@@ -49,12 +49,12 @@ public class PaygAuthDataExtractor {
     private static final Path PAYG_INSTANCE_INFO_JSON = Path.of("/var/cache/rhn/payg.json");
     private static final int VALIDITY_MINUTES = 11;
 
-    private static final String CONNECTION_TIMEOUT_PROPEERRTY = "java.payg.connection_timeout";
-    private static final String WAIT_RESPONSE_TIMEOUT_PROPEERRTY = "java.payg.repsonse_timeout";
+    private static final String CONNECTION_TIMEOUT_PROPERTY = "java.payg.connection_timeout";
+    private static final String WAIT_RESPONSE_TIMEOUT_PROPERTY = "java.payg.repsonse_timeout";
 
     // time in milliseconds
-    private static final int CONNECTION_TIMEOUT = Config.get().getInt(CONNECTION_TIMEOUT_PROPEERRTY, 5000);
-    private static final int RESPONSE_TIMEOUT = Config.get().getInt(WAIT_RESPONSE_TIMEOUT_PROPEERRTY, 20000);
+    private static final int CONNECTION_TIMEOUT = Config.get().getInt(CONNECTION_TIMEOUT_PROPERTY, 5000);
+    private static final int RESPONSE_TIMEOUT = Config.get().getInt(WAIT_RESPONSE_TIMEOUT_PROPERTY, 20000);
 
     private static final Logger LOG = LogManager.getLogger(PaygAuthDataExtractor.class);
 
@@ -65,17 +65,17 @@ public class PaygAuthDataExtractor {
         .create();
 
     public enum OsSpecificExtractor {
-        SLES_EXTRACTOR("SLE", "sudo python3", "script/payg_extract_repo_data.py"),
-        RHEL_EXTRACTOR("RHEL", "sudo /usr/libexec/platform-python", "script/rhui_extract_repo_data.py"),
-        RHEL7_EXTRACTOR("RHEL7", "sudo python", "script/rhui7_extract_repo_data.py");
+        SLES_EXTRACTOR("SLE", "/usr/bin/sudo /usr/bin/python3", "script/payg_extract_repo_data.py"),
+        RHEL_EXTRACTOR("RHEL", "/usr/bin/sudo /usr/libexec/platform-python", "script/rhui_extract_repo_data.py"),
+        RHEL7_EXTRACTOR("RHEL7", "/usr/bin/sudo /usr/bin/python", "script/rhui7_extract_repo_data.py");
 
         private final String osLabel;
         private final String scriptExecutor;
         private final String extractorScript;
 
         /**
          * Constructor
-         * @param osLabelIn the lable
+         * @param osLabelIn the label
          * @param scriptExecutorIn the script executor
          * @param extractorScriptIn the script path
          */

java/code/src/com/redhat/rhn/taskomatic/task/repomd/RpmRepositoryWriter.java

@@ -423,7 +423,7 @@ public void writeRepomdFiles(Channel channel) {
 
         if (ConfigDefaults.get().isMetadataSigningEnabled()) {
             String[] signCommand = new String[2];
-            signCommand[0] = "mgr-sign-metadata";
+            signCommand[0] = "/usr/bin/mgr-sign-metadata";
             signCommand[1] = prefix + "repomd.xml";
             cmdExecutor.execute(signCommand);
             createdFiles.add(new File(prefix, "repomd.xml.asc"));

java/code/src/com/suse/manager/webui/controllers/bootstrap/AbstractMinionBootstrapper.java

@@ -138,7 +138,7 @@ private boolean hasCorrectSSHFileOwnership() throws IOException, CommandExecutio
         }
 
         File knownHostsFile = new File(SALT_SSH_DIR_PATH + "/known_hosts");
-        String cmd = "sudo /usr/bin/ls -la " + knownHostsFile.getPath();
+        String cmd = "/usr/bin/sudo /usr/bin/ls -la " + knownHostsFile.getPath();
         Process prc = Runtime.getRuntime().exec(cmd);
 
         try {

java/code/src/com/suse/manager/webui/utils/LoginHelper.java

@@ -411,7 +411,7 @@ public static Boolean isSchemaUpgradeRequired() {
 
     private static String getRpmSchemaVersion(String schemaName) {
         String[] rpmCommand = new String[4];
-        rpmCommand[0] = "rpm";
+        rpmCommand[0] = "/usr/bin/rpm";
         rpmCommand[1] = "-q";
         rpmCommand[2] = "--qf=%{VERSION}-%{RELEASE}";
         rpmCommand[3] = schemaName;

java/spacewalk-java.changes.mackdk.avoid-executing-commands-from-PATH

@@ -0,0 +1 @@
+- Use absolute paths when invoking external commands

python/spacewalk/satellite_tools/repo_plugins/yum_src.py

@@ -154,7 +154,7 @@ def __synchronize_gpg_keys(self):
             # which are not needed and can cause issues when importing into the RPMDB
             os.system(
                 # pylint: disable-next=consider-using-f-string
-                "gpg -q --batch --no-options --no-default-keyring --no-permission-warning --keyring {} --export --export-options export-clean -a > {}".format(
+                "/usr/bin/gpg -q --batch --no-options --no-default-keyring --no-permission-warning --keyring {} --export --export-options export-clean -a > {}".format(
                     SPACEWALK_GPG_KEYRING, f.name
                 )
             )
@@ -199,7 +199,7 @@ def __synchronize_gpg_keys(self):
                     # We delete this key from the RPM database to allow importing the newer version.
                     os.system(
                         # pylint: disable-next=consider-using-f-string
-                        "rpm --dbpath {} -e gpg-pubkey-{}-{}".format(
+                        "/usr/bin/rpm --dbpath {} -e gpg-pubkey-{}-{}".format(
                             REPOSYNC_ZYPPER_RPMDB_PATH, key, zypper_gpg_keys[key]
                         )
                     )
@@ -957,12 +957,12 @@ def _prep_zypp_repo_url(self, url, uln_repo):
             sys.stdout.write(str(msg) + "\n")
             os.system(
                 # pylint: disable-next=consider-using-f-string
-                'awk \'BEGIN {{c=0;}} /BEGIN CERT/{{c++}} {{ print > "{0}/cert." c ".pem"}}\' < {1}'.format(
+                '/usr/bin/awk \'BEGIN {{c=0;}} /BEGIN CERT/{{c++}} {{ print > "{0}/cert." c ".pem"}}\' < {1}'.format(
                     _ssl_capath, self.sslcacert
                 )
             )
             # pylint: disable-next=consider-using-f-string
-            os.system("c_rehash {} 2&>1 /dev/null".format(_ssl_capath))
+            os.system("/usr/bin/c_rehash {} 2&>1 /dev/null".format(_ssl_capath))
             query_params["ssl_capath"] = _ssl_capath
         if self.sslclientcert:
             query_params["ssl_clientcert"] = self.sslclientcert

python/spacewalk/satellite_tools/reposync.py

@@ -521,7 +521,7 @@ def __init__(
             CFG.set("DEBUG", log_level)
             rhnLog.initLOG(log_path, log_level)
             # os.fchown isn't in 2.4 :/
-            os.system("chgrp " + CFG.httpd_group + " " + log_path)
+            os.system("/usr/bin/chgrp " + CFG.httpd_group + " " + log_path)
 
         # pylint: disable-next=consider-using-f-string
         log2disk(0, "Command: %s" % str(sys.argv))

python/spacewalk/spacewalk-backend.changes.mackdk.avoid-executing-commands-from-PATH

@@ -0,0 +1 @@
+- Use absolute paths when invoking external commands

spacewalk/admin/salt-secrets-config.py

@@ -144,7 +144,7 @@
     ]
 ):
     os.system(
-        "openssl req -newkey rsa:4096 -x509 -sha256 -days 3650 -nodes -out /etc/salt/pki/api/salt-api.crt -keyout /etc/salt/pki/api/salt-api.key -subj '/CN=localhost'"
+        "/usr/bin/openssl req -newkey rsa:4096 -x509 -sha256 -days 3650 -nodes -out /etc/salt/pki/api/salt-api.crt -keyout /etc/salt/pki/api/salt-api.key -subj '/CN=localhost'"
     )
     os.chown(
         "/etc/salt/pki/api/salt-api.crt",

spacewalk/admin/spacewalk-admin.changes.mackdk.avoid-executing-commands-from-PATH

@@ -0,0 +1 @@
+- Use absolute paths when invoking external commands

susemanager-utils/susemanager-sls/salt/bootloader/autoinstall.sls

@@ -11,8 +11,8 @@ mgr_copy_initrd:
 
 {% set loader_type = salt['cmd.run']('if [ -f /etc/sysconfig/bootloader ]; then source /etc/sysconfig/bootloader 2> /dev/null; fi;
 if [ -z "${LOADER_TYPE}" ]; then
-if [ $(which grubonce 2> /dev/null) ] && [ !$(which grub2-mkconfig 2> /dev/null) ]; then LOADER_TYPE="grub";
-elif [ $(which elilo 2> /dev/null) ] && [ !$(which grub2-mkconfig 2> /dev/null) ]; then LOADER_TYPE="elilo";
+if [ $(/usr/bin/which grubonce 2> /dev/null) ] && [ !$(/usr/bin/which grub2-mkconfig 2> /dev/null) ]; then LOADER_TYPE="grub";
+elif [ $(/usr/bin/which elilo 2> /dev/null) ] && [ !$(/usr/bin/which grub2-mkconfig 2> /dev/null) ]; then LOADER_TYPE="elilo";
 fi;
 fi; echo "${LOADER_TYPE}"', python_shell=True) %}
 {% if loader_type == 'grub' %}
@@ -27,7 +27,7 @@ mgr_create_grub_entry:
 
 mgr_grub_boot_once:
   cmd.run:
-    - name: grubonce "{{ pillar.get('uyuni-reinstall-name') }}"
+    - name: /usr/sbin/grubonce "{{ pillar.get('uyuni-reinstall-name') }}"
     - onchanges:
       - file: mgr_create_grub_entry
 {% elif loader_type == 'elilo' %}
@@ -50,7 +50,7 @@ mgr_set_default_boot:
 
 mgr_elilo_copy_config:
   cmd.run:
-    - name: elilo
+    - name: /sbin/elilo
     - onchanges:
       - file: mgr_create_elilo_entry
       - file: mgr_set_default_boot
@@ -72,7 +72,7 @@ mgr_set_default_boot:
 
 mgr_generate_grubconf:
   cmd.run:
-    - name: grub2-mkconfig -o /boot/grub2/grub.cfg
+    - name: /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg
     - onchanges:
       - file: mgr_copy_kernel
       - file: mgr_copy_initrd
@@ -82,7 +82,7 @@ mgr_generate_grubconf:
 
 mgr_autoinstall_start:
   cmd.run:
-    - name: shutdown -r +1
+    - name: /usr/sbin/shutdown -r +1
     - require:
 {% if loader_type == 'grub' %}
       - cmd: mgr_grub_boot_once

susemanager-utils/susemanager-sls/salt/bootstrap/init.sls

@@ -168,7 +168,7 @@ bootstrap_repo:
 {% set salt_minion_installed = (salt['pkg.info_installed']('venv-salt-minion', attr='version', failhard=False).get('venv-salt-minion', {}).get('version') != None) %}
 check_bootstrap_dbg:
   cmd.run:
-    - name: echo "{{ salt_minion_installed }}"
+    - name: /usr/bin/echo "{{ salt_minion_installed }}"
 {% set venv_available_request = salt_minion_installed or salt['http.query'](bootstrap_repo_url + 'venv-enabled-' + grains['osarch'] + '.txt', status=True, verify_ssl=False) %}
 {# Prefer venv-salt-minion if available and not disabled #}
 {%- set use_venv_salt = salt['pillar.get']('mgr_force_venv_salt_minion') or ((salt_minion_installed or (0 < venv_available_request.get('status', 404) < 300)) and not salt['pillar.get']('mgr_avoid_venv_salt_minion')) %}
@@ -192,10 +192,10 @@ salt-minion-package:
 {# hack until transactional_update.run is fixed to use venv-salt-call #}
 {# Writing  to the future - find latest etc overlay which was created for package installation and use that as etc root #}
 {# this only works here in bootstrap when we are not running in transaction #}
-{%- set pending_transaction_id = salt['cmd.run']('snapper --no-dbus list --columns=number | grep "+" | tr -d "+"', python_shell=True) %}
+{%- set pending_transaction_id = salt['cmd.run']('/usr/bin/snapper --no-dbus list --columns=number | /usr/bin/grep "+" | tr -d "+"', python_shell=True) %}
 {%- if not pending_transaction_id %}
 {#  if we did not get pending transaction id, write to current upperdir #}
-{%- set pending_transaction_id = salt['cmd.run']('snapper --no-dbus list --columns number | grep "*" | tr -d "*"', python_shell=True) %}
+{%- set pending_transaction_id = salt['cmd.run']('/usr/bin/snapper --no-dbus list --columns number | /usr/bin/grep "*" | tr -d "*"', python_shell=True) %}
 {%- endif %}
 {# increase transaction id by 1 since jinja is doing this before new transaction for package install is created #}
 {# this is working under assumption there will be only one transaction between jinja render and actual package installation #}
@@ -332,7 +332,7 @@ copy_transactional_conf_file_to_etc:
     - name: /etc/transactional-update.conf
     - source: /usr/etc/transactional-update.conf
     - unless:
-      - test -f /etc/transactional-update.conf
+      - /usr/bin/test -f /etc/transactional-update.conf
 
 transactional_update_set_reboot_method_systemd:
   file.keyvalue:
@@ -345,7 +345,7 @@ transactional_update_set_reboot_method_systemd:
     - require:
       - file: copy_transactional_conf_file_to_etc
     - unless:
-      - grep -P '^(?=[\s]*+[^#])[^#]*(REBOOT_METHOD=(?!auto))' /etc/transactional-update.conf
+      - /usr/bin/grep -P '^(?=[\s]*+[^#])[^#]*(REBOOT_METHOD=(?!auto))' /etc/transactional-update.conf
 
 disable_reboot_timer_transactional_minions:
   cmd.run:

susemanager-utils/susemanager-sls/salt/bootstrap/remove_traditional_stack.sls

@@ -42,7 +42,7 @@ remove_traditional_stack:
 {%- if grains['os_family'] == 'Suse' %}
       - suseRegisterInfo
 {%- endif %}
-    - unless: rpm -q spacewalk-proxy-common || rpm -q spacewalk-common
+    - unless: /usr/bin/rpm -q spacewalk-proxy-common || /usr/bin/rpm -q spacewalk-common
 
 # only removing apt-transport-spacewalk above
 # causes apt-get update to 'freeze' if this

susemanager-utils/susemanager-sls/salt/bootstrap/set_proxy.sls

@@ -20,7 +20,7 @@
 restart:
   mgrcompat.module_run:
     - name: cmd.run_bg
-    - cmd: "sleep 2; service {{ salt_service }} restart"
+    - cmd: "/usr/bin/sleep 2; /usr/sbin/service {{ salt_service }} restart"
     - python_shell: true
 
 {% else -%}

susemanager-utils/susemanager-sls/salt/certs/init.sls

@@ -8,4 +8,4 @@ mgr_proxy_ca_cert_symlink:
   file.symlink:
     - name: /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
     - target: /etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT
-    - onlyif: grep -Eq "^proxy.rhn_parent *= *[a-zA-Z0-9]+" /etc/rhn/rhn.conf && -e /etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT
+    - onlyif: /usr/bin/grep -Eq "^proxy.rhn_parent *= *[a-zA-Z0-9]+" /etc/rhn/rhn.conf && -e /etc/pki/trust/anchors/RHN-ORG-TRUSTED-SSL-CERT

susemanager-utils/susemanager-sls/salt/certs/redhat.sls

@@ -3,7 +3,7 @@ enable_ca_store:
   cmd.run:
     - name: /usr/bin/update-ca-trust enable
     - runas: root
-    - unless: "/usr/bin/update-ca-trust check | grep \"PEM/JAVA Status: ENABLED\""
+    - unless: "/usr/bin/update-ca-trust check | /usr/bin/grep \"PEM/JAVA Status: ENABLED\""
 {%- endif %}
 
 mgr_ca_cert:

susemanager-utils/susemanager-sls/salt/channels/init.sls

@@ -16,7 +16,7 @@ include:
 {%- set is_dnf = salt['pkg.version']("dnf") %}
 
 {%- if is_dnf %}
-{%- set dnf_plugins = salt['cmd.run']("find /usr/lib -type d -name dnf-plugins -printf '%T@ %p\n' | sort -nr | cut -d ' ' -s -f 2- | head -n 1", python_shell=True) %}
+{%- set dnf_plugins = salt['cmd.run']("/usr/bin/find /usr/lib -type d -name dnf-plugins -printf '%T@ %p\n' | /usr/bin/sort -nr | /usr/bin/cut -d ' ' -s -f 2- | /usr/bin/head -n 1", python_shell=True) %}
 {%- if dnf_plugins %}
 mgrchannels_susemanagerplugin_dnf:
   file.managed:
@@ -42,7 +42,7 @@ mgrchannels_enable_dnf_plugins:
     - pattern: plugins=.*
     - repl: plugins=1
 {#- default is '1' when option is not specififed #}
-    - onlyif: grep -e 'plugins=0' -e 'plugins=False' -e 'plugins=no' /etc/dnf/dnf.conf
+    - onlyif: /usr/bin/grep -e 'plugins=0' -e 'plugins=False' -e 'plugins=no' /etc/dnf/dnf.conf
 {%- endif %}
 
 {# this break the susemanagerplugin as it overwrite HTTP headers (bsc#1214601) #}
@@ -51,7 +51,7 @@ mgrchannels_disable_dnf_rhui_plugin:
     - name: /etc/yum/pluginconf.d/dnf_rhui_plugin.conf
     - pattern: enabled=.*
     - repl: enabled=0
-    - onlyif: grep -e 'enabled=1' -e 'enabled=True' -e 'enabled=yes' /etc/yum/pluginconf.d/dnf_rhui_plugin.conf
+    - onlyif: /usr/bin/grep -e 'enabled=1' -e 'enabled=True' -e 'enabled=yes' /etc/yum/pluginconf.d/dnf_rhui_plugin.conf
 
 {%- endif %}
 
@@ -79,7 +79,7 @@ mgrchannels_enable_yum_plugins:
     - name: /etc/yum.conf
     - pattern: plugins=.*
     - repl: plugins=1
-    - onlyif: grep plugins=0 /etc/yum.conf
+    - onlyif: /usr/bin/grep plugins=0 /etc/yum.conf
 
 {%- endif %}
 {%- endif %}
@@ -147,7 +147,7 @@ mgrchannels_dnf_clean_all:
     - runas: root
     - onchanges:
        - file: "/etc/yum.repos.d/susemanager:channels.repo"
-    -  unless: "/usr/bin/dnf repolist | grep \"repolist: 0$\""
+    -  unless: "/usr/bin/dnf repolist | /usr/bin/grep \"repolist: 0$\""
 {%- endif %}
 {%- if is_yum %}
 mgrchannels_yum_clean_all:
@@ -156,7 +156,7 @@ mgrchannels_yum_clean_all:
     - runas: root
     - onchanges: 
        - file: "/etc/yum.repos.d/susemanager:channels.repo"
-    -  unless: "/usr/bin/yum repolist | grep \"repolist: 0$\""
+    -  unless: "/usr/bin/yum repolist | /usr/bin/grep \"repolist: 0$\""
 {%- endif %}
 {%- elif grains['os_family'] == 'Debian' %}
 install_gnupg_debian:

susemanager-utils/susemanager-sls/salt/cleanup_minion/init.sls

@@ -60,15 +60,15 @@ mgr_remove_salt_master_key:
 {%- if salt['pillar.get']('contact_method') not in ['ssh-push', 'ssh-push-tunnel'] %}
 mgr_disable_salt:
   cmd.run:
-    - name: systemctl disable {{ salt_minion_name }}
+    - name: /usr/bin/systemctl disable {{ salt_minion_name }}
     - require:
       - file: mgr_remove_salt_config
 
 {%- if not grains['transactional'] %}
 mgr_stop_salt:
   cmd.run:
     - bg: True
-    - name: sleep 9 && systemctl stop {{ salt_minion_name }}
+    - name: /usr/bin/sleep 9 && /usr/bin/systemctl stop {{ salt_minion_name }}
     - order: last
     - require:
       - file: mgr_remove_salt_config