packages icon indicating copy to clipboard operation
packages copied to clipboard

atlas-sw-probe: tweak SSH key permissions

Open kempniu opened this issue 1 year ago • 0 comments

Do not run chown or chgrp for probe key files since the probe scripts are run as root anyway.

Do not run chmod 644 for /etc/atlas/probe_key since an SSH private key should not be readable by any user except the owner.

Maintainer: @ja-pa Cc: @Ansuel (author of 0afe371babf851d1ce239c75525e99bcef3626d0, see #15488)


Perhaps I am missing something obvious, but the efforts that the init script makes to chown atlas:atlas various files is puzzling to me, given that upstream scripts do not seem to be designed for running as any user other than root (there are e.g. writes to hard-coded paths that are only writable by root. (The atlas user is created by the atlas-probe package.)

In fact, if the SSH key files were owned by root in the first place, ssh itself would detect that the permissions set for them by the init script are too open. However, that check is only triggered if the user that ssh is run as is the same as the user owning the key file. (In this case, that's root vs. atlas, so the 644 mode set for the private key does not prevent ssh from working.)

This PR attempts to ensure that file modes are set identical no matter whether ssh-keygen or dropbearkey/dropbearconvert are used for generating the probe keys.

kempniu avatar Jul 23 '24 11:07 kempniu