canonical/cloud-init

World writable /usr/lib/cloud-init/clouddir should not be left behind

Open

#4,189 opened on Jun 15, 2023

View on GitHubContributor guide
 (5 comments) (1 reaction) (0 assignees)Python (1,108 forks)auto 404
buggood first issue

Repository metrics

Stars
 (3,772 stars)
PR merge metrics
 (PR metrics pending)

Description

Bug report

Work was done last year to ensure that when /tmp and /var/tmp are hardend with noexec, cloud-init will use an alternative path under /usr/lib/cloud-init

However, /usr/lib/cloud-init/clouddir is created as world writable and left behind after cloud-init has exited.

Steps to reproduce the problem

Run cloud-init with a /tmp and /var/tmp that are mounted with noexec

If possible, /usr/lib/cloud-init/clouddir should be created as non-world read/writable. But if that's not possible, at the least it should be removed when cloud-init exits.

Contributor guide

Research direction
Trace the creation of /usr/lib/cloud init/clouddir in the codebase, check file permissions set by os.mkdir or tempfile, and implement proper permissions (e.g., 0o755) and cleanup on exit.
Tech stack
python
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65