In-box secret files written before their chmod: lc-creds, stacks tee, and the workspace token
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
Research direction
Read the three write sites in pkg/core/recipes/recipes.yaml (around lines 1008–1014 and the agent-workspace step) and pkg/core/stacks/stacks.yaml (around lines 326–331), then inspect workspace_caddyfile_mode_test.go for the test pattern. Add the restrictive creation mode at each write and keep the trailing chmod 600; add a test that runs the real step lines under umask 022 without that chmod. Done when the test confirms each file is mode 0600.
Written by the indexing model from the issue text.
Description
Finding (from the #3633 scan, plus the #3656 follow-up)
Secret-bearing files are created at the default umask and tightened only afterwards, so they are briefly readable by other in-box users:
pkg/core/recipes/recipes.yaml(~1008-1014):lc-credswritten by pythonopen, chmod after.pkg/core/stacks/stacks.yaml(~326-331):teethenchmod 600.pkg/core/recipes/recipes.yamlagent-workspace step:printf ... > /opt/wsauth/tokenthenchmod 600. The sibling Caddyfile was fixed in #3656; this one was left out of that scope.
The fix is the same as #3656: umask 077 before the write, chmod 600 after, or a create-with-mode write.
Acceptance criteria
- Each of the three writes is preceded by
umask 077(or created with mode 0600), withchmod 600after. - Test in the recipes package, in the style of
workspace_caddyfile_mode_test.go: the real step lines run underumask 022with the trailing chmod removed produce a 0600 file. - Fails on
mainbefore the change.
Follow-up to #3633 and #3656.
- Dominant language
- Go
- Stars
- 296
- Forks
- 38
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 648
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from FootprintAI/Containarium
-
model:sonnet runtime:claude security size:S
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
FootprintAI/Containarium#3624 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
FootprintAI/Containarium#2491 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 3/5 1-2 days Newbie friendliness 72/100
FootprintAI/Containarium#3672 ·
Maintainers usually reply within 1 day
-
In-box root chown/mkdir on user-owned paths: decide whether box-internal root is a trust boundaryOpenmodel:sonnet needs-decision runtime:claude security size:M
Difficulty 5/5 Over a week Newbie friendliness 35/100
FootprintAI/Containarium#3670 ·
Maintainers usually reply within 1 day
-
model:sonnet runtime:claude security size:S
Difficulty 3/5 1-2 days Newbie friendliness 68/100
FootprintAI/Containarium#3669 ·
Maintainers usually reply within 1 day
All issues in FootprintAI/Containarium
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 5 days
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
keyxmakerx/Chronicle#2190 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
llm-d/llm-d-inference-sim#897 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
inference-sim/inference-sim#2110 ·
Maintainers usually reply within 1 day
-
backlog
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
EchoTools/nevr-runtime#2385 ·
Maintainers usually reply within 1 day