Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enforce more strict permissions for files in Cosmos #49

Merged
merged 3 commits into from
Jul 3, 2024
Merged

Enforce more strict permissions for files in Cosmos #49

merged 3 commits into from
Jul 3, 2024

Commits on Nov 17, 2023

  1. Set same permissions for /root/.ssh/authorized_keys 

    in post-tasks.d/010fix-ssh-perms as is done by
Puppet with sunet::ssh_keys.
    @Gijutsu
    Gijutsu committed Nov 17, 2023
    Configuration menu
    Copy the full SHA
    ca353ed View commit details
    Browse the repository at this point in the history

  2. Make sure that /root in overlay is owned by root 

    as well as that /root/.ssh and its content is
only owned and readable by root. This is redundant
if the previous permissions were properly applied
and no other changes have been made by the user
or something else, but is added for good measure
as a layered defense.
    @Gijutsu
    Gijutsu committed Nov 17, 2023
    Configuration menu
    Copy the full SHA
    75e566a View commit details
    Browse the repository at this point in the history

  3. Make sure that COSMOS_BASE is only readable 

    by root since it's possible that the directory
can contain files that after applying the
overlay to / only should be read or writable
by root.
    @Gijutsu
    Gijutsu committed Nov 17, 2023
    Configuration menu
    Copy the full SHA
    8d4ce2d View commit details
    Browse the repository at this point in the history