In-box root chown/mkdir on user-owned paths: decide whether box-internal root is a trust boundary
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
Read the listed sites in pkg/core/container/manager.go, pkg/core/recipes/recipes.yaml, pkg/core/stacks/stacks.yaml, pkg/core/container/envfile.go, and registry_mirror.go, along with the no-follow helpers from #3650. First resolve whether box-internal root is a trust boundary; then classify each site with its reason. If sites are fixed, add a planted-symlink test per site and verify the links are not followed.
Written by the indexing model from the issue text.
Description
Question (owner decision needed)
Several root-run steps inside a box operate on paths the box user owns: pkg/core/container/manager.go (~991-998, mkdir -p, ln -sf, chown -R under the user's ~/.config), pkg/core/recipes/recipes.yaml (~386, chown of $BOX_HOME/slides), pkg/core/stacks/stacks.yaml (~320, chown -R of kubeflow manifests), and pkg/core/container/envfile.go (~72) and registry_mirror.go (~117) (root mkdir -p).
The box user is normally sudo-capable, so a symlink race here may not cross a real boundary. Whether it does decides the fix:
- If box-internal root is a trust boundary: apply the no-follow helpers from #3650 to each site.
- If it is not: record that in the threat model and close the findings as not-a-problem for this boundary.
Default if no answer: treat it as a trust boundary and apply the no-follow helpers. That is the safer reading.
Acceptance criteria (once decided)
- Each site is classified (fix / not-a-problem) with the reason on this issue.
- Fixed sites use the no-follow helpers, with a test per site that a planted symlink is not followed.
Follow-up to #3633 (scan rows marked follow-up).
- Dominant language
- Go
- Stars
- 296
- Forks
- 38
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 648
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from FootprintAI/Containarium
-
model:sonnet runtime:claude security size:S
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
FootprintAI/Containarium#3671 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
FootprintAI/Containarium#3624 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
FootprintAI/Containarium#2491 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 3/5 1-2 days Newbie friendliness 72/100
FootprintAI/Containarium#3672 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 3/5 1-2 days Newbie friendliness 68/100
FootprintAI/Containarium#3669 ·
Maintainers usually reply within 1 day
All issues in FootprintAI/Containarium
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 5 days
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
keyxmakerx/Chronicle#2190 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
llm-d/llm-d-inference-sim#897 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
inference-sim/inference-sim#2110 ·
Maintainers usually reply within 1 day
-
backlog
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
EchoTools/nevr-runtime#2385 ·
Maintainers usually reply within 1 day