Overview
Request 1194743 revoked
Supplement to the "crowdsec" package. We're currently missing packaged Remediators ("Bouncers").
- Created by aeneas_jaissle
- In state revoked
-
Package maintainer:
aeneas_jaissle
- Supersedes 1193773
@Alexander_Naumov, @WernerFink, @ahodgkinson, @bitshuffler, @dbuss, @duwe, @gregfreemyer, @jjolly, @jsegitz, @lrupp, @mseben, @msmeissn, @ojkastl_buildservice, @psmt, @varkoly, @vpereirabr: review reminder
Looks good, thanks for the SR.
install -D -m 0600 scripts/_bouncer.sh %{buildroot}%{_usr}/lib/%{name}/_bouncer.sh
Shouldn't the file be executable? And why only allow root access to that file? There should be no "secrets" in it.
install -D -m 0600 scripts/_bouncer.sh %{buildroot}%{_usr}/lib/%{name}/_bouncer.sh
Why allow everyone read access (755 on the directory) and then restrict everyone but root to read this file?
I take it the service needs to be run as root to have permissions for using iptables etc?
Good catch, that wasn't intended. The script is now 0755, but should normally only be used by root (-scripts). It does configuration manipulation like adding a local API key to the bouncer config. New SR on its' way.
Request History
aeneas_jaissle created request
Supplement to the "crowdsec" package. We're currently missing packaged Remediators ("Bouncers").
ojkastl_buildservice revoked request
The source project 'home:aeneas_jaissle:branches:security2' has been removed
Thanks for reworking the SR.
#install -D -m 0644 config/%%{name}.service %%{buildroot}%%{_unitdir}/%%{name}.serviceSet executable bitline from the changelog, as the package was not submitted there is not yet a need for a strict changelog. And unless this is the only change, packaging changes do not always have to be in the changelog (depends on the packager's opinion).I had a copy&paste error in my last comment (on the previous SR). I think we can loosen up the permissions on the
%{_sysconfdir}/crowdsec/bouncers/%{name}.yamlfile. As it belongs toroot:root, I think we can go with 640 permission. You would need to set them in the %files section, I believe:%config(noreplace) %attrs(0640,root,root) %{_sysconfdir}/crowdsec/bouncers/%{name}.yamlHave a nice day!
Johannes
What’s the benefit loosening permissions on the config yaml?
@Alexander_Naumov, @WernerFink, @ahodgkinson, @bitshuffler, @dbuss, @duwe, @gregfreemyer, @jjolly, @jsegitz, @lrupp, @mseben, @msmeissn, @ojkastl_buildservice, @psmt, @varkoly, @vpereirabr: review reminder