Petals Distribution

petals-cli and petals-registry-cli debian packages let default CLI configuration readable by all

Details

  • Type: Bug Bug
  • Status: Resolved Resolved
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 5.0.0-M1
  • Fix Version/s: 5.0.0-RC-1
  • Component/s: Packaging
  • Security Level: Public
  • Description:
    Hide

    It would make sense to have them only readable to the user/group.

    Optionaly, it could make sense to have it assigned to petals/petals (and not root/root).
    Like this root can add a user to the petals group and let him use petals-cli with the default configuration.

    Show
    It would make sense to have them only readable to the user/group. Optionaly, it could make sense to have it assigned to petals/petals (and not root/root). Like this root can add a user to the petals group and let him use petals-cli with the default configuration.
  • Environment:
    -

Issue Links

Depends
 

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Christophe DENEUX added a comment - Wed, 27 Jan 2016 - 17:43:13 +0100

I think you are talking about the files /etc/petals-cli/petals-cli.default and /etc/petals-registry-cli/petals-registry-cli.default.

Your idea is interesting. IMO, in the same way, Petals CLI and Petals Registry CLI should be runnable only by users member of the group petals. This is more restrictive but less easily usable because a user must added to the group petals before to be able to use CLIs.

What does our product owner think about this ?

Show
Christophe DENEUX added a comment - Wed, 27 Jan 2016 - 17:43:13 +0100 I think you are talking about the files /etc/petals-cli/petals-cli.default and /etc/petals-registry-cli/petals-registry-cli.default. Your idea is interesting. IMO, in the same way, Petals CLI and Petals Registry CLI should be runnable only by users member of the group petals. This is more restrictive but less easily usable because a user must added to the group petals before to be able to use CLIs. What does our product owner think about this ?
Christophe DENEUX made changes - Wed, 27 Jan 2016 - 17:43:24 +0100
Field Original Value New Value
Summary petals-cli and petals-registry-cli debian package let default cli configuration readable by all petals-cli and petals-registry-cli debian package let default CLI configuration readable by all
Priority Blocker [ 1 ]
Christophe DENEUX made changes - Wed, 27 Jan 2016 - 17:43:38 +0100
Summary petals-cli and petals-registry-cli debian package let default CLI configuration readable by all petals-cli and petals-registry-cli debian packages let default CLI configuration readable by all
Hide
Permalink
Victor NOËL added a comment - Thu, 28 Jan 2016 - 09:55:13 +0100

No no, I don't agree with the second point: it's bad practice to restrict the execution of the CLIs. Anyway if an user really wants it, he can install it locally.

The thing of first importance is: /etc/petals-cli/petals-cli.default and /etc/petals-registry-cli/petals-registry-cli.default are readable by everybody and it is a huge security risk.

The second point, less important is: do we want that user added to the petals group can read them?

Show
Victor NOËL added a comment - Thu, 28 Jan 2016 - 09:55:13 +0100 No no, I don't agree with the second point: it's bad practice to restrict the execution of the CLIs. Anyway if an user really wants it, he can install it locally. The thing of first importance is: /etc/petals-cli/petals-cli.default and /etc/petals-registry-cli/petals-registry-cli.default are readable by everybody and it is a huge security risk. The second point, less important is: do we want that user added to the petals group can read them?
Hide
Permalink
Christophe DENEUX added a comment - Thu, 28 Jan 2016 - 10:34:44 +0100

You are right, if an user really wants a CLI, he can install it locally from ZIP archive.

I agree to restrict readability of configuration files to the members of group petals. If the user is not a member of the group, a warning should be displayed in mode 'console' (petals-cli -C): "Your are not granted to access the default configuration file: ...".

And don't forget to update the user documentation.

Show
Christophe DENEUX added a comment - Thu, 28 Jan 2016 - 10:34:44 +0100 You are right, if an user really wants a CLI, he can install it locally from ZIP archive. I agree to restrict readability of configuration files to the members of group petals. If the user is not a member of the group, a warning should be displayed in mode 'console' (petals-cli -C): "Your are not granted to access the default configuration file: ...". And don't forget to update the user documentation.
Christophe DENEUX made changes - Thu, 28 Jan 2016 - 14:57:36 +0100
Link This issue depends on PETALSESBCLI-140 [ PETALSESBCLI-140 ]
Christophe DENEUX made changes - Thu, 28 Jan 2016 - 14:59:07 +0100
Link This issue depends on PETALSREGCLI-11 [ PETALSREGCLI-11 ]
Christophe DENEUX made changes - Thu, 28 Jan 2016 - 16:28:55 +0100
Status New [ 10000 ] Open [ 10002 ]
Priority Blocker [ 1 ] Major [ 3 ]
Christophe DENEUX made changes - Thu, 28 Jan 2016 - 16:28:57 +0100
Status Open [ 10002 ] In Progress [ 10003 ]
Christophe DENEUX made changes - Thu, 28 Jan 2016 - 16:29:03 +0100
Status In Progress [ 10003 ] Resolved [ 10004 ]
Fix Version/s 5.0.0 [ 10574 ]
Resolution Fixed [ 1 ]
Transition Status Change Time Execution Times Last Executer Last Execution Date
New New Open Open
1d 7h 1m
1
Christophe DENEUX
Thu, 28 Jan 2016 - 16:28:55 +0100
Open Open In Progress In Progress
2s
1
Christophe DENEUX
Thu, 28 Jan 2016 - 16:28:57 +0100
In Progress In Progress Resolved Resolved
6s
1
Christophe DENEUX
Thu, 28 Jan 2016 - 16:29:03 +0100



People

Dates

  • Created:
    Wed, 27 Jan 2016 - 09:27:41 +0100
    Updated:
    Thu, 28 Jan 2016 - 16:29:03 +0100
    Resolved:
    Thu, 28 Jan 2016 - 16:29:03 +0100
Atlassian JIRA (v4.1.2#531) | Report a problem | Request a feature | Contact administrators
Powered by a free Atlassian JIRA open source license for Petals ESB. Try JIRA - bug tracking software for your team.