Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure /etc isn't writable by group #168

Merged
merged 1 commit into from
Jun 5, 2024
Merged

Ensure /etc isn't writable by group #168

merged 1 commit into from
Jun 5, 2024

Conversation

sjpb
Copy link
Collaborator

@sjpb sjpb commented Jun 5, 2024

munged checks on startup that the path to its key is secure.

Because Rocky-9-GenericCloud-Base-9.4-20240523.0.x86_64.qcow2 changed the permissions on /etc this image fails with:

munged: Error: Keyfile is insecure: group-writable permissions without sticky bit set on "/etc"

Permissions comparison:

# Rocky-9-GenericCloud-Base-9.3-20231113.0.x86_64.qcow2
[rocky@sb-rl9-3 ~]$ ls -ld /etc/
drwxr-xr-x. 93 root root 8192 Jun  5 14:54 /etc/

# Rocky-9-GenericCloud-Base-9.4-20240523.0.x86_64.qcow2
[rocky@sb-rl9-4 ~]$ ls -ld /etc/
drwxrwxr-x. 88 root root 8192 Jun  5 14:54 /etc/

@sjpb sjpb requested a review from a team as a code owner June 5, 2024 15:11
@sjpb sjpb requested a review from m-bull June 5, 2024 15:37
Copy link
Contributor

@m-bull m-bull left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems fine, but it would be good to know why this changed in the image, just in case of unintended consequences later...

@sjpb
Copy link
Collaborator Author

sjpb commented Jun 5, 2024

@sjpb sjpb merged commit a599130 into master Jun 5, 2024
34 checks passed
@sjpb sjpb deleted the fix/RL9.4-etc-munge branch June 5, 2024 15:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants