Conversation
|
I am a bot, here are the test results for this PR for commit 0ece153 :
|
| fi | ||
|
|
||
| # set permissions and import user crontabs | ||
| lsiown "${cron_user}":"${cron_user}" "/config/crontabs/${cron_user}" |
There was a problem hiding this comment.
This was important. Having the cron user own the crontab in /config meant running as root inside the container required root access on the host. Having abc own the root crontab in /config will allow unprivileged users to modify the container's root cron. If the container has a docker socket that could lead to all kinds of shenanigans.
There was a problem hiding this comment.
Most downstream images recursively chown config, no point in fighting it.
Custom init also had the same issue and the solution was to put them in a separate mount outside of config, which is not worth the hassle here.
|
I am a bot, here are the test results for this PR for commit a377283 :
|
3 participants
PR proposal for all os baseimages:
/defaults/crontabsis for user customizable crontabs and they take priority over/etc/crontabs/etc/crontabsis for non-user customizable crontabs/config/crontabsis only created and imported from if/defaults/crontabsis present in image/etc/crontabsis active/defaults/crontabs, we should also include/etc/crontabsas a fallback for RO environments/config/crontabs/rootmeans an unprivileged user can run scripts as root inside the container