Project

General

Profile

Bug #8065

ACL Posix on Git repos

Added by Alexandre Anriot about 4 years ago. Updated almost 4 years ago.

Status:
Released
Priority:
3
Category:
System integration
Target version:
Severity:
User visibility:
Effort required:
Priority:

Description

Hello,

As seens with François, if the server as Posix ACL with a "default" type like that:

  1. file: var/rudder/configuration-repository/.git/objects # owner: root # group: rudder # flags: s
    user::rwx
    group::rwx
    other::r-x
    default:user::rwx
    default:group::r-x
    default:other::r-x

Then on that case, user "ncf-api-venv", belonging to "rudder", does NOT have write rights on Git repos because of "default:group::r-x".

To prevent that case, the installation shoud delete ACL rules with the following command:

setfacl -R -k /var/rudder/

Thanks !


Subtasks

Bug #8272: ACL Posix on Git repos - fix bug in case command is missingReleased2016-05-11Benoît PECCATTEActions
#1

Updated by François ARMAND about 4 years ago

  • Subject changed from ACL Posix sur le dépôt Git to ACL Posix on Git repos
  • Description updated (diff)
#2

Updated by Nicolas CHARLES about 4 years ago

  • Tags set to Sponsored
  • Category set to System integration
  • Assignee set to Alexis MOUSSET
  • Target version set to 3.0.15

Alexis,
I think you're the most suited for this one

#3

Updated by Vincent MEMBRÉ about 4 years ago

  • Target version changed from 3.0.15 to 3.0.16
#4

Updated by Jonathan CLARKE about 4 years ago

Alexandre Anriot wrote:

Hello,

As seens with François, if the server as Posix ACL with a "default" type like that:

  1. file: var/rudder/configuration-repository/.git/objects
  2. owner: root
  3. group: rudder
  4. flags: s
    user::rwx
    group::rwx
    other::r-x
    default:user::rwx
    default:group::r-x
    default:other::r-x

Then on that case, user "ncf-api-venv", belonging to "rudder", does NOT have write rights on Git repos because of "default:group::r-x".

To prevent that case, the installation shoud delete ACL rules with the following command:

setfacl -R -k /var/rudder/

Thanks !

Thanks for the report, Alex. We'll implement this command on initial installation only (then, if a user modifies their ACLs, they can, if they know what they're doing).

#5

Updated by Jonathan CLARKE about 4 years ago

  • Tags changed from Sponsored to Sponsored, Next minor release
#6

Updated by Alexis MOUSSET about 4 years ago

  • Target version changed from 3.0.16 to 2.11.21
#7

Updated by Alexis MOUSSET about 4 years ago

  • Status changed from New to In progress
#8

Updated by Alexis MOUSSET about 4 years ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from Alexis MOUSSET to Benoît PECCATTE
  • Pull Request set to https://github.com/Normation/rudder-packages/pull/916
#9

Updated by Alexis MOUSSET about 4 years ago

  • Status changed from Pending technical review to Pending release
  • % Done changed from 0 to 100
#10

Updated by Vincent MEMBRÉ almost 4 years ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 2.11.21, 3.0.16, 3.1.10 and 3.2.3 which were released on 2016-06-01, but not announced.

Also available in: Atom PDF