SUNET/net-ops
10
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Make sure that COSMOS_BASE is only readable

Browse source 
by root since it's possible that the directory
can contain files that after applying the
overlay to / only should be read or writable
by root.
This commit is contained in:
John Van de Meulebrouck Brendgard 2023-11-17 15:03:47 +01:00
parent 75e566ab61
commit 8d4ce2d1b7
No known key found for this signature in database
GPG key ID: 807A5FD4B3337B77
2 changed files with 48 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
global/post-tasks.d/014set-cosmos-permissions Executable file
View file

@ -0,0 +1,24 @@
#!/bin/sh
#
# Set Cosmos directory permissions so that
# the files cannot be read by anyone but root,
# since it's possible that the directory
# can contain files that after applying the
# overlay to / only should be read or writable
# by root.
set -e
self=$(basename "$0")
if ! test -d "$COSMOS_BASE"; then
test -z "$COSMOS_VERBOSE" || echo "$self: COSMOS_BASE was not found. Aborting change of permissions."
exit 0
fi
args=""
if [ "x$COSMOS_VERBOSE" = "xy" ]; then
args="-v"
fi
chown ${args} root:root "$COSMOS_BASE"
chmod ${args} 750 "$COSMOS_BASE"

24
global/pre-tasks.d/014set-cosmos-permissions Executable file
View file

@ -0,0 +1,24 @@
#!/bin/sh
#
# Set Cosmos directory permissions so that
# the files cannot be read by anyone but root,
# since it's possible that the directory
# can contain files that after applying the
# overlay to / only should be read or writable
# by root.
set -e
self=$(basename "$0")
if ! test -d "$COSMOS_BASE"; then
test -z "$COSMOS_VERBOSE" || echo "$self: COSMOS_BASE was not found. Aborting change of permissions."
exit 0
fi
args=""
if [ "x$COSMOS_VERBOSE" = "xy" ]; then
args="-v"
fi
chown ${args} root:root "$COSMOS_BASE"
chmod ${args} 750 "$COSMOS_BASE"