fixing permission bits for 'ADD root /'
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- docker, git
- Domain
- devops, infrastructure
Research direction
Start by examining the Dockerfile instruction ADD root /, hack/build.sh, and fix-permissions, then reproduce the permission behavior with umask 0077 and a build that reaches USER 26. Determine which permission changes are in scope, including the proposed filesystem package reinstall before yum clean all; done should prevent non-root commands from failing because of inaccessible system directories.
Written by the indexing model from the issue text.
Description
I recently set 'umask 0077' on my box. This causes that 'git clone' results in lot of files
and directories with at most rwx------ permissions, which is desired (for me, as I
consider this to be rather safe default on multi-user box while I also need to have 'o+x'
on my home directory).
When the image is then build on such box, Dockerfile instruction ADD root / causes
that (for example) /usr directory has drwx------ root root permissions and, for all
users except for root, we are unable to execve() any file within /usr/bin/... That
results in magic error messages for any command executed after USER 26 instruction.
This shouldn't be an immediate issue, but ATM the permissions under root are rather
not precisely defined. And I'm thinking about writing pull request for hack/build.sh
or fix-permissions explicitly ensuring that (some important) files/directories under root
git directories have explicit permissions, others have 755 (directories) and 644 (regular
files without execute bit held by git) and 755 (for executable files).
Also, it could be considered good policy to re-install filesystem package right before
the yum clean all call, that re-sets the permissions for some important system directories
according to defaults.
WDYT?
- Dominant language
- PLpgSQL
- Stars
- 178
- Forks
- 220
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sclorg/postgresql-container
-
Difficulty 2/5 1-2 days Newbie friendliness 72/100
sclorg/postgresql-container#661 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
sclorg/postgresql-container#669 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
sclorg/postgresql-container#668 ·
-
Dockerfile failing Open
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
sclorg/postgresql-container#656 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 50/100
sclorg/postgresql-container#654 ·
All issues in sclorg/postgresql-container
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
needs-triage🔍
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
kind/bug needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 72/100
matrixorigin/matrixone#29223 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·