fixing permission bits for 'ADD root /'

Open
#136 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
docker, git

Research direction

Start by examining the Dockerfile instruction ADD root /, hack/build.sh, and fix-permissions, then reproduce the permission behavior with umask 0077 and a build that reaches USER 26. Determine which permission changes are in scope, including the proposed filesystem package reinstall before yum clean all; done should prevent non-root commands from failing because of inaccessible system directories.

Written by the indexing model from the issue text.

Description

easyfix

I recently set 'umask 0077' on my box. This causes that 'git clone' results in lot of files
and directories with at most rwx------ permissions, which is desired (for me, as I
consider this to be rather safe default on multi-user box while I also need to have 'o+x'
on my home directory).

When the image is then build on such box, Dockerfile instruction ADD root / causes
that (for example) /usr directory has drwx------ root root permissions and, for all
users except for root, we are unable to execve() any file within /usr/bin/... That
results in magic error messages for any command executed after USER 26 instruction.

This shouldn't be an immediate issue, but ATM the permissions under root are rather
not precisely defined. And I'm thinking about writing pull request for hack/build.sh
or fix-permissions explicitly ensuring that (some important) files/directories under root
git directories have explicit permissions, others have 755 (directories) and 644 (regular
files without execute bit held by git) and 755 (for executable files).

Also, it could be considered good policy to re-install filesystem package right before
the yum clean all call, that re-sets the permissions for some important system directories
according to defaults.

WDYT?

Dominant language
PLpgSQL
Stars
178
Forks
220
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sclorg/postgresql-container

All issues in sclorg/postgresql-container

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.