Skip to content

DEV: Ensure secure file permissions by default #627

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 3, 2022
Merged

DEV: Ensure secure file permissions by default #627

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions discourse-setup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -884,7 +884,7 @@ then
DATE=`date +"%Y-%m-%d-%H%M%S"`
BACKUP=$app_name.yml.$DATE.bak
echo Saving old file as $BACKUP
cp $web_file containers/$BACKUP
install -m0600 $web_file containers/$BACKUP
if [ "$DEBUG" != "1" ]
then
echo "Stopping existing container in 5 seconds or Control-C to cancel."
Expand All @@ -902,7 +902,7 @@ else
then
check_ports
fi
cp -v $web_template $web_file
install -v -m0600 $web_template $web_file
if [ "$data_name" == "data" ]
then
echo "--------------------------------------------------"
Expand All @@ -918,7 +918,7 @@ else
echo "Problem changing DISCOURSE_DB_PASSWORD" in $web_file
fi

cp -v $data_template $data_file
install -v -m0600 $data_template $data_file
quote=\'
sed -i -e "s/password ${quote}SOME_SECRET${quote}/password '$DISCOURSE_DB_PASSWORD'/w $changelog" $data_file
if [ -s $changelog ]
Expand Down
19 changes: 10 additions & 9 deletions launcher
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,6 +278,16 @@ check_prereqs() {
fi
exit 1
fi

# 8. container definition file is accessible and is not insecure (world-readable)
if [[ ! -e "$config_file" || ! -r "$config_file" ]]; then
echo "ERROR: $config_file does not exist or is not readable."
echo
echo "Available configs ( `cd containers && ls -dm *.yml | tr -s '\n' ' ' | awk '{ gsub(/\.yml/, ""); print }'`)"
exit 1
elif [[ "$(find $config_file -perm -004)" ]]; then
echo "WARNING: $config_file file is world-readable. You can secure this file by running: chmod o-rwx $config_file"
fi
}


Expand Down Expand Up @@ -486,15 +496,6 @@ fi
exit 0
}

if [ ! "$command" == "setup" ]; then
if [[ ! -e $config_file ]]; then
echo "Config file was not found, ensure $config_file exists"
echo
echo "Available configs ( `cd containers && ls -dm *.yml | tr -s '\n' ' ' | awk '{ gsub(/\.yml/, ""); print }'`)"
exit 1
fi
fi

docker_version=($($docker_path --version))
docker_version=${test[2]//,/}
restart_policy=${restart_policy:---restart=always}
Expand Down