toolshed/abra
4
5
Fork 23
Code Issues 87 Pull Requests 13 Packages Releases 45 Activity

Default UNIX permissions on ~/.abra/servers are too open #580

New Issue
Closed
opened 2025-06-26 22:09:03 +00:00 by 3wordchant · 1 comment
3wordchant commented 2025-06-26 22:09:03 +00:00
Owner
Copy Link
Copy Source

Thanks @voltrate for the report.

Default UNIX permissions on ~/.abra/servers are 644, which means other system users can read files there. Given that some recipes store secrets in .env files, this may not be ideal. Changing to 600 seems like it would improve security, for no reduction in usability that I can think of.

Thanks @voltrate for the report. Default UNIX permissions on `~/.abra/servers` are `644`, which means other system users can read files there. Given that some recipes store secrets in `.env` files, this may not be ideal. Changing to `600` seems like it would improve security, for no reduction in usability that I can think of.
👍 2
3wordchant added the bug label 2025-06-26 22:09:03 +00:00
decentral1se self-assigned this 2025-07-08 09:58:37 +00:00
decentral1se added this to the Abra v0.11.x project 2025-07-08 10:06:51 +00:00
decentral1se moved this to In Progress in Abra v0.11.x on 2025-08-12 21:15:42 +00:00
decentral1se moved this to Done in Abra v0.11.x on 2025-08-17 09:18:44 +00:00
decentral1se commented 2025-08-17 12:06:45 +00:00
Owner
Copy Link
Copy Source

Woops, abra needs +x to create subdirs like ~/.abra/servers/foo. I changed it to 0700. We can keep 0600 for subdirs because we only have .env files there afterwards. See #599 for more chaos 🤸 Wow, got that wrong again, even subdirs need 0700 8a3be01c3e

Woops, `abra` needs `+x` to create subdirs like `~/.abra/servers/foo`. I changed it to `0700`. ~~We can keep `0600` for subdirs because we only have `.env` files there afterwards. See https://git.coopcloud.tech/toolshed/abra/pulls/599 for more chaos 🤸~~ Wow, got that wrong again, even subdirs need `0700` https://git.coopcloud.tech/toolshed/abra/commit/8a3be01c3efaaf999a06aca01f31ec14277a0a8a
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 build
go build related issues
 ci/cd
Building things with CI/CD
 critical fix
https://docs.coopcloud.tech/federation/resolutions/passed/010/
 design
UI/UX
 documentation
Documenting all the things
 duplicate
This issue or pull request already exists
 easy-first-issue
Something for new people to get stuck into. We hope it's easy!
 enhancement
New feature
 help wanted
Need some help
 i10n
Everything to do with localisation
 i18n
Everything to do with internationalisation
 installer
Everything to do with the install script.
 invalid
Something is wrong
 question
More information is needed
 release
Release management
 release-candidate
Related to the new release candidate
 security
Security related
 tech-debt
test
Unit/integration testing
 wontfix
This won't be fixed
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Abra v0.11.x
Done
Assignees
Clear assignees
3wordchant aadil (Aadil Ayub) abra-bot (Abra Bot) ammaratef45 amras (Sarma) Apfelwurm BornDeleuze (Born Deleuze) Brooke carla cas (Cassowary) coopcloud cyrnel dannygroenewegen (Danny Groenewegen) decentral1se (d1) dede devydave fauno (fauno) hex (Josh Dukes) iexos jade (Jade Ambrose) jjsfunhouse jmakdah2 (Jackie Makdah) joe-irving (Joe Irving) kawaiipunk (KawaiiPunk) knoflook kolaente lambdabundesverband linnealovespie (April) moosemower moritz notplants oxaliq (sorrel) p4u1 (p4u1) pharaohgraphy (Andrew 🐦‍🔥❤️‍🔥✴️) renovate-bot (Comrade Renovate Bot) ripclap simon sixsmith (Sixsmith) stevensting (stevensting) trav (Trav Fryer) val (val (he/him)) yksflip
No Assignees decentral1se
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: toolshed/abra#580