[7.x](backport #27779) [Elastic Agent] Add validation to ensure certificate paths are absolute.

x-pack/elastic-agent/CHANGELOG.next.asciidoc

@@ -82,6 +82,7 @@
 - Fix issue with atomic extract running in K8s {pull}27396[27396]
 - Fix issue with install directory in state path in K8s {pull}27396[27396]
 - Change output.elasticsearch.proxy_disabled flag to output.elasticsearch.proxy_disable so fleet uses it. {issue}27670[27670] {pull}27671[27671]
+- Add validation for certificate flags to ensure they are absolute paths. {pull}27779[27779]
 
 ==== New features
 

x-pack/elastic-agent/pkg/agent/cmd/enroll.go

@@ -9,6 +9,7 @@ import (
  "fmt"
  "os"
  "os/signal"
+ "path/filepath"
  "strconv"
  "strings"
  "syscall"
@@ -71,6 +72,26 @@ func addEnrollFlags(cmd *cobra.Command) {
  cmd.Flags().BoolP("delay-enroll", "", false, "Delays enrollment to occur on first start of the Elastic Agent service")
 }
 
+func validateEnrollFlags(cmd *cobra.Command) error {
+ ca, _ := cmd.Flags().GetString("certificate-authorities")
+ if ca != "" && !filepath.IsAbs(ca) {
+ return errors.New("--certificate-authorities must be provided as an absolute path", errors.M("path", ca), errors.TypeConfig)
+ }
+ esCa, _ := cmd.Flags().GetString("fleet-server-es-ca")
+ if esCa != "" && !filepath.IsAbs(esCa) {
+ return errors.New("--fleet-server-es-ca must be provided as an absolute path", errors.M("path", esCa), errors.TypeConfig)
+ }
+ fCert, _ := cmd.Flags().GetString("fleet-server-cert")
+ if fCert != "" && !filepath.IsAbs(fCert) {
+ return errors.New("--fleet-server-cert must be provided as an absolute path", errors.M("path", fCert), errors.TypeConfig)
+ }
+ fCertKey, _ := cmd.Flags().GetString("fleet-server-cert-key")
+ if fCertKey != "" && !filepath.IsAbs(fCertKey) {
+ return errors.New("--fleet-server-cert-key must be provided as an absolute path", errors.M("path", fCertKey), errors.TypeConfig)
+ }
+ return nil
+}
+
 func buildEnrollmentFlags(cmd *cobra.Command, url string, token string) []string {
  if url == "" {
  url, _ = cmd.Flags().GetString("url")
@@ -184,6 +205,11 @@ func buildEnrollmentFlags(cmd *cobra.Command, url string, token string) []string
 }
 
 func enroll(streams *cli.IOStreams, cmd *cobra.Command, args []string) error {
+ err := validateEnrollFlags(cmd)
+ if err != nil {
+ return err
+ }
+
  fromInstall, _ := cmd.Flags().GetBool("from-install")
 
  pathConfigFile := paths.ConfigFile()

x-pack/elastic-agent/pkg/agent/cmd/install.go

@@ -42,6 +42,11 @@ would like the Agent to operate.
 }
 
 func installCmd(streams *cli.IOStreams, cmd *cobra.Command, args []string) error {
+ err := validateEnrollFlags(cmd)
+ if err != nil {
+ return err
+ }
+
  isAdmin, err := install.HasRoot()
  if err != nil {
  return fmt.Errorf("unable to perform install command while checking for administrator rights, %v", err)