[OMN-DEF] PXE mapping file created with insecure permissions (0644 instead of 0640)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- ansible, python
- Domain
- infrastructure, security
Research direction
Search the orchestrator setup and input generation paths for pxe_mapping_file.csv and inspect where its permissions are set. Run the setup or provisioning flow followed by the orchestrator validation step to reproduce the mode mismatch. Done when a freshly generated file has mode 0640 and validation passes.
Written by the indexing model from the issue text.
Description
Defect
The PXE mapping file (pxe_mapping_file.csv) is created with mode 0644 (world-readable) during orchestrator setup or input generation. The orchestrator's own validation then rejects this file because it is accessible by others, failing with:
orchestrator_config: PXE mapping file '/opt/omnia/orchestrator/input/project_default/pxe_mapping_file.csv'
has insecure mode 0644. It must not be group-writable or accessible by others;
run 'chmod 640 /opt/omnia/orchestrator/input/project_default/pxe_mapping_file.csv'.
The PXE mapping file contains sensitive node inventory data (MAC addresses, BMC IPs, IB addresses, service tags) and should not be world-readable. The validation correctly enforces a maximum of 0640, but the file generation step does not set the correct permissions, causing the validation to fail on every fresh deployment.
Steps to Reproduce
- Run orchestrator setup / provision which generates the PXE mapping file
- Run the orchestrator validate step
- Validation fails on file permissions
Expected Result
The PXE mapping file should be created with mode 0640 (owner read/write, group read, no other access) so that validation passes without manual intervention.
Actual Result
The file is created with mode 0644. The user must manually run chmod 640 on the file before validation will pass.
- Dominant language
- Python
- Stars
- 9
- Forks
- 175
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 171
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dell/omnia
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
`src/telemetry/containers/build_images.sh` should have localcopy build_actionMay be free again @priti-parate claimed this 28 days ago, and no pull request is open. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
dell/omnia#5425 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
Warning: SLURM_REPO_URL and SLURM_REPO_NAME must be provided.May be free again @priti-parate claimed this 28 days ago, and no pull request is open. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dell/omnia#5423 · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
SpikeInterface/spikeinterface#4924 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
aws-samples/sample-per-model-bedrock#782 ·
Maintainers usually reply within 1 day
-
bug javascript
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
No-op PreToolUse:Bash hook (bash_hook.py) still registered synchronously; adds latency and can time out at 10 sPossibly taken @alexgr-agent claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
alexgreensh/token-optimizer#313 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100