Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove sudo from ddev-dbserver or at least from a hardened version #2607

Closed
rfay opened this issue Nov 4, 2020 · 0 comments
Closed

Remove sudo from ddev-dbserver or at least from a hardened version #2607

rfay opened this issue Nov 4, 2020 · 0 comments

Comments

@rfay
Copy link
Member

rfay commented Nov 4, 2020

Describe the bug

ddev-dbserver has sudo and uses it. A fair bit. And it has a writeable .ddev mount in /mnt/ddev_config, so a break-in might be able to use sudo to make a setuid file on the host.

It's unlikely that shell-access to the dbserver would be obtained, but it would sure be better if we could just get sudo off of here.

A related technique (leaving sudo here) would be to share only the .ddev/db_snapshots directory as writeable, and share the .ddev directory as read-only. Might be easier and better.

To Reproduce
Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Version and configuration information (please complete the following information):

  • Host computer OS and Version: [e.g. Windows 10, macOS Catalina]
  • Docker Desktop version if on macOS or Windows (from "About Docker Desktop")
  • ddev version information (use ddev version)
  • config.yaml contents for the misbehaving project
  • Do you have any custom configuration (nginx, php, mysql) in the .ddev folder? If so, have you tried without them?

Additional context
Add any other context about the problem here. Thanks!

@rfay rfay added this to the v1.16 milestone Nov 4, 2020
@rfay rfay changed the title Remove sudo from ddev-dbserver Remove sudo from ddev-dbserver or at least from a hardened version Nov 5, 2020
@rfay rfay modified the milestones: v1.16, v1.17 Nov 5, 2020
@rfay rfay modified the milestones: v1.17, v1.18 Feb 12, 2021
@rfay rfay closed this as completed in 42ffa6b Feb 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant