fix file ownership for tighter security [JIRA: TOOLS-232] [JIRA: RIAK-2381] #196
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Merge latest changes into 2.0
Basho-JIRA
changed the title
JeetKunDoug
changed the title
|
create jira issue |
Basho-JIRA
changed the title
|
Are you planning on fixing perms on other platforms too? |
|
Yes, other affected platforms will be fixed - just working out some details on which ones need it internally. |
JeetKunDoug
changed the title
|
For Centos 7: Reviewed ownership for /usr/sbin files - also were owned by riak. 12fee7a fixes that. For FreeBSD: |
JeetKunDoug
force-pushed
the
dr/fix_permissions_on_init_d_script
branch
from
e70f7b8 to
981c495
Compare
added 3 commits
March 8, 2016 20:37
…instead of {{platform_base_dir}} so it's writable for the riak user
- Changes to make sure we install as many things as possible as root:root or root:wheel, rather than package_install_user:package_install_group. - Updates to make it more clear when using variables that they will be writable by the package_install_user. - Always use `package_data_dir` as home directory for user, as package_base_dir should not be writable or owned by package user and more. Erlang cookie file `.erlang.cookie` is created in the home directory, so it must be writable.
JeetKunDoug
force-pushed
the
dr/fix_permissions_on_init_d_script
branch
from
63afdf2 to
4a1aaca
Compare
JeetKunDoug
force-pushed
the
dr/fix_permissions_on_init_d_script
branch
from
8d4ae5a to
dc8a0ea
Compare
JeetKunDoug
changed the title
I'm not entirely clear on why this is necessary, because it seems like the @owner/@group directives that the Makefile generates should take care of it for us. But this should hopefully fix the issue that Doug and I saw where the SMF files were getting installed as the user that built the package instead of root.
| @@ -127,29 +133,29 @@ packing_list_files: $(BUILD_STAGE_DIR) templates | |||
| echo "@comment Packing /opt/local/etc files" >> +CONTENTS && \ | |||
| echo "@cwd /opt/local" >> +CONTENTS && \ | |||
| echo "@owner root" >> +CONTENTS && \ | |||
| echo "@group {{package_install_user}}" >> +CONTENTS && \ | |||
| echo "@group riak" >> +CONTENTS && \ | |||
There was a problem hiding this comment.
Was this change intentional? I think it should stay as package_install_user since node_package isn't supposed to be riak-specific, right?
There was a problem hiding this comment.
No, clearly not intentional - thanks for catching it. You mind pushing a fix?
There was a problem hiding this comment.
Yep, I'll get right on it. Heh, and sorry for my denseness, I guess you're right it clearly wasn't intentional :).
|
👍 b92e7ba |
nickelization
added a commit
that referenced
this pull request
Mar 18, 2016
fix file ownership for tighter security [JIRA: TOOLS-232] [JIRA: RIAK-2381]
This was referenced Mar 21, 2016
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Need to audit file ownership across packages in general - follow conventions of other packages and install as few things as possible as riak:riak (since most systems install executables/libraries as root:root or root:wheel)
Specific issues found:
init.d script in RPM should be owned by root:root not riak:riak - can create a potential security issue.
As a workaround, you should ensure that your init.d scripts are owned by root:root not riak:riak.
on FreeBSD systems using older pkg_add (vs. pkgng) /usr/local/sbin/riak should be owned by root:wheel rather than {{package_install_user}}:{{package_install_group}}
Many installers install most/all of the riak binaries/libraries as riak:riak - change to root:wheel, root:bin, or root:root where appropriate
.erlang.cookiefile is written wherever theriakuser's home directory is. There were several packages that had set it to be {{platform_base_dir}} rather than {{platform_data_dir}}, and {{platform_base_dir}} really should not be writable to the service user. Make sure that any configuration files are readable by riak - in a few cases, this means groupriakwith appropriate (640) permissions - in others, the default is to install 644 so the files are world-readable. Not changing this for now.riak startand make sure it starts cleanly.riak-admin pingriak-admin testto make sure you can actually write/read datariak-admin attach-directTodo list for testing: