Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set least permissive file mode for files created/managed by etcd-backup-restore #821

Merged
merged 2 commits into from
Dec 30, 2024
Merged

Set least permissive file mode for files created/managed by etcd-backup-restore #821

merged 2 commits into from
Dec 30, 2024

Conversation

shreyas-s-rao
Copy link
Collaborator

/area compliance security
/kind task

What this PR does / why we need it:
Set least permissive file mode for files created/managed by etcd-backup-restore. These are the following changes related to this:

  • Change permission of file safe_guard to 0600, to handle files previously created with wider permissions.
  • Set umask to 0077 to ensure all files created by etcd-backup-restore have mode not greater than 0600
  • Use file mode 0600 when opening bolt DB file (mode used for creation if file does not exist)
  • Update restoration documentation (unrelated to file permissions, but just a small doc update)

Which issue(s) this PR fixes:
Fixes #820

Special notes for your reviewer:
/invite @ishan16696

Release note:

Set umask to `0077` to restrict permissions for files created by etcd-backup-restore.

@shreyas-s-rao shreyas-s-rao added this to the v0.33.0 milestone Dec 26, 2024
@shreyas-s-rao shreyas-s-rao requested a review from a team as a code owner December 26, 2024 12:20
@gardener-robot gardener-robot added the needs/review Needs review label Dec 26, 2024
@gardener-robot gardener-robot added area/compliance Compliance related area/security Security related kind/task General task size/xs Size of pull request is tiny (see gardener-robot robot/bots/size.py) labels Dec 26, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 26, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 26, 2024
ishan16696
ishan16696 approved these changes Dec 26, 2024
View reviewed changes
Copy link
Member

@ishan16696 ishan16696 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just 1 nit.
LGTM!!

pkg/initializer/validator/datavalidator.go Show resolved Hide resolved
@shreyas-s-rao
Copy link
Collaborator Author

@ishan16696 I've addressed your comment. PTAL

@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 27, 2024
ishan16696
ishan16696 approved these changes Dec 27, 2024
View reviewed changes
Copy link
Member

@ishan16696 ishan16696 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @shreyas-s-rao for PR.
LGTM!!

@shreyas-s-rao shreyas-s-rao added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Dec 27, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Dec 27, 2024
@shreyas-s-rao shreyas-s-rao merged commit 867f84d into gardener:master Dec 30, 2024
9 checks passed
@shreyas-s-rao shreyas-s-rao deleted the fix/file-permissions branch December 30, 2024 13:02
@gardener-robot gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Dec 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ishan16696 ishan16696 ishan16696 approved these changes

Assignees
No one assigned
Labels
area/compliance Compliance related area/security Security related kind/task General task needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/review Needs review size/xs Size of pull request is tiny (see gardener-robot robot/bots/size.py) status/closed Issue is closed (either delivered or triaged)
Projects
None yet
Milestone
v0.33.0
Development

Successfully merging this pull request may close these issues.

Use least permissive file mode
5 participants
@shreyas-s-rao @ishan16696 @gardener-robot-ci-1 @gardener-robot-ci-3 @gardener-robot