Bug #8065: ACL Posix on Git repos - Rudder - Issue Tracker

Actions

Copy link

Bug #8065

closed

ACL Posix on Git repos

Added by Alexandre Anriot over 8 years ago. Updated over 2 years ago.

Status:

Released

Priority:

Assignee:

Benoît PECCATTE

Category:

System integration

Target version:

2.11.21

Pull Request:

https://github.com/Normation/rudder-p...

Severity:

UX impact:

User visibility:

Effort required:

Priority:

Name check:

Fix check:

Regression:

Description

Hello,

As seens with François, if the server as Posix ACL with a "default" type like that:

file: var/rudder/configuration-repository/.git/objects
owner: root
group: rudder
flags: s
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::r-x
default:other::r-x

Then on that case, user "ncf-api-venv", belonging to "rudder", does NOT have write rights on Git repos because of "default:group::r-x".

To prevent that case, the installation shoud delete ACL rules with the following command:

setfacl -R -k /var/rudder/

Thanks !

Subtasks 1 (0 open — 1 closed)

Actions

Copy link

Updated by François ARMAND over 8 years ago

Subject changed from ACL Posix sur le dépôt Git to ACL Posix on Git repos
Description updated (diff)

Actions

Copy link

Updated by Nicolas CHARLES over 8 years ago

Translation missing: en.field_tag_list set to Sponsored
Category set to System integration
Assignee set to Alexis Mousset
Target version set to 3.0.15

Alexis,
I think you're the most suited for this one

Actions

Copy link

Updated by Vincent MEMBRÉ over 8 years ago

Target version changed from 3.0.15 to 3.0.16

Actions

Copy link

Updated by Jonathan CLARKE over 8 years ago

Alexandre Anriot wrote:

Hello,

As seens with François, if the server as Posix ACL with a "default" type like that:

file: var/rudder/configuration-repository/.git/objects

owner: root

group: rudder

flags: s
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::r-x
default:other::r-x

Then on that case, user "ncf-api-venv", belonging to "rudder", does NOT have write rights on Git repos because of "default:group::r-x".

To prevent that case, the installation shoud delete ACL rules with the following command:

setfacl -R -k /var/rudder/

Thanks !

Thanks for the report, Alex. We'll implement this command on initial installation only (then, if a user modifies their ACLs, they can, if they know what they're doing).

Actions

Copy link