Project

General

Profile

Actions

Bug #8065

closed

ACL Posix on Git repos

Added by Alexandre Anriot about 5 years ago. Updated almost 5 years ago.

Status:
Released
Priority:
3
Category:
System integration
Target version:
Severity:
User visibility:
Effort required:
Priority:

Description

Hello,

As seens with François, if the server as Posix ACL with a "default" type like that:

  1. file: var/rudder/configuration-repository/.git/objects
  2. owner: root
  3. group: rudder
  4. flags: s
    user::rwx
    group::rwx
    other::r-x
    default:user::rwx
    default:group::r-x
    default:other::r-x

Then on that case, user "ncf-api-venv", belonging to "rudder", does NOT have write rights on Git repos because of "default:group::r-x".

To prevent that case, the installation shoud delete ACL rules with the following command:

setfacl -R -k /var/rudder/

Thanks !


Subtasks 1 (0 open1 closed)

Bug #8272: ACL Posix on Git repos - fix bug in case command is missingReleasedBenoît PECCATTE2016-05-11Actions
Actions #1

Updated by François ARMAND about 5 years ago

  • Subject changed from ACL Posix sur le dépôt Git to ACL Posix on Git repos
  • Description updated (diff)
Actions #2

Updated by Nicolas CHARLES about 5 years ago

  • Tags set to Sponsored
  • Category set to System integration
  • Assignee set to Alexis MOUSSET
  • Target version set to 3.0.15

Alexis,
I think you're the most suited for this one

Actions #3

Updated by Vincent MEMBRÉ about 5 years ago

  • Target version changed from 3.0.15 to 3.0.16
Actions #4

Updated by Jonathan CLARKE about 5 years ago

Alexandre Anriot wrote:

Hello,

As seens with François, if the server as Posix ACL with a "default" type like that:

  1. file: var/rudder/configuration-repository/.git/objects
  2. owner: root
  3. group: rudder
  4. flags: s
    user::rwx
    group::rwx
    other::r-x
    default:user::rwx
    default:group::r-x
    default:other::r-x

Then on that case, user "ncf-api-venv", belonging to "rudder", does NOT have write rights on Git repos because of "default:group::r-x".

To prevent that case, the installation shoud delete ACL rules with the following command:

setfacl -R -k /var/rudder/

Thanks !

Thanks for the report, Alex. We'll implement this command on initial installation only (then, if a user modifies their ACLs, they can, if they know what they're doing).

Actions #5

Updated by Jonathan CLARKE about 5 years ago

  • Tags changed from Sponsored to Sponsored, Next minor release
Actions #6

Updated by Alexis MOUSSET about 5 years ago

  • Target version changed from 3.0.16 to 2.11.21
Actions #7

Updated by Alexis MOUSSET about 5 years ago

  • Status changed from New to In progress
Actions #8

Updated by Alexis MOUSSET about 5 years ago

  • Status changed from In progress to Pending technical review
  • Assignee changed from Alexis MOUSSET to Benoît PECCATTE
  • Pull Request set to https://github.com/Normation/rudder-packages/pull/916
Actions #9

Updated by Alexis MOUSSET about 5 years ago

  • Status changed from Pending technical review to Pending release
  • % Done changed from 0 to 100
Actions #10

Updated by Vincent MEMBRÉ almost 5 years ago

  • Status changed from Pending release to Released

This bug has been fixed in Rudder 2.11.21, 3.0.16, 3.1.10 and 3.2.3 which were released on 2016-06-01, but not announced.

Actions

Also available in: Atom PDF