Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set umask to 0077 for etcd process #16

Merged
merged 2 commits into from
Oct 19, 2023

Conversation

AleksandarSavchev
Copy link
Member

How to categorize this PR?

/area security
/kind enhancement

What this PR does / why we need it:
Set umask to 0077 for etcd process. This PR is similar to the one for etcd-custom-image ref.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

The `etcd` process now runs with umask set to `0077`, this way the files it creates have no permissions on `group` and `others` level.

@AleksandarSavchev AleksandarSavchev requested a review from a team as a code owner October 12, 2023 11:35
@gardener-robot gardener-robot added needs/review Needs review area/security Security related kind/enhancement Enhancement, improvement, extension size/xs Size of pull request is tiny (see gardener-robot robot/bots/size.py) labels Oct 12, 2023
@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Oct 12, 2023
Copy link
Contributor

@shreyas-s-rao shreyas-s-rao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@unmarshall is this the right place to add a umask call? Or should it be within etcdApp.Setup()?
/needs second-opinion

@gardener-robot gardener-robot removed the needs/review Needs review label Oct 13, 2023
cmd/etcd.go Outdated Show resolved Hide resolved
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Oct 19, 2023
@gardener-robot-ci-1 gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Oct 19, 2023
@unmarshall
Copy link
Contributor

/lgtm

@gardener-robot gardener-robot added the reviewed/lgtm Has approval for merging label Oct 19, 2023
@unmarshall unmarshall merged commit bdc439e into gardener:main Oct 19, 2023
1 check passed
@gardener-robot gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Oct 19, 2023
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Oct 19, 2023
@ThormaehlenFred ThormaehlenFred added the area/compliance Compliance related label Feb 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/compliance Compliance related area/security Security related kind/enhancement Enhancement, improvement, extension needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) reviewed/lgtm Has approval for merging reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) size/xs Size of pull request is tiny (see gardener-robot robot/bots/size.py) status/closed Issue is closed (either delivered or triaged)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants