-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set more restrictive perms on alloc dir #2674
Comments
@jshuping Good catch! This was a regression introduced in 0.5.6! |
Seeing this with nomad 0.7.1 on Linux-x64, is there a way to restrict this much more? E.g., 0755 for the task directory, 0700 for secrets, and user:group configurable for both? (because that depends on the container, and many containers drop privileges nowadays). |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
0.5.6
Operating system and Environment details
Ubuntu 16.04 AWS EC2
Suggestion
This is a suggestion to enhance security.
Nomad's
data_dir
contains these subdirectories:drwxr-xr-x 5 root root 4096 May 25 12:01 alloc
drwx------ 3 root root 4096 May 25 08:45 client
And each alloc dir is created with permissions like:
drwxr-xr-x 4 root root 4096 May 25 10:50 60ec8de6-7426-1aff-6ffc-c678202f33ae
Unless the operator restricted the permissions to the overall
data_dir
by some other means,any user on the system can cd into each allocdir and read the secrets generated by the jobs'
template stanzas.
Perhaps we could have that
alloc
dir also set restrictive permissions in the same wayclient
does.The text was updated successfully, but these errors were encountered: