Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix opensearch-dashboard user's permission to allow reading the service configuration files #4038

Conversation

smortex
Copy link
Contributor

@smortex smortex commented Sep 19, 2023

In #3952, the permissions where changed to fix some inconsistencies in
the .deb and .rpm packaging.

This change restricted access to the configuration files (which where
previously readable by all users) but failed to adjust the files
ownership so that the service can access these files.

Ensure the configuration directory and files belong to the root user and
the opensearch-dashboards group

Signed-off-by: Romain Tartière [email protected]

@smortex
Copy link
Contributor Author

smortex commented Sep 19, 2023

@peterzhuamazon I saw this trying RC .deb packages (first RC I try). It looks like it slept-through when I was working on #3952… I think it needs special labeling so that it is included in the 2.10.0 release. Thank you!

@codecov
Copy link

codecov bot commented Sep 19, 2023

Codecov Report

Merging #4038 (b866ee5) into main (76479cb) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #4038   +/-   ##
=======================================
  Coverage   92.10%   92.10%           
=======================================
  Files         187      187           
  Lines        5674     5674           
=======================================
  Hits         5226     5226           
  Misses        448      448           

In  opensearch-project#3952, the permissions where changed to fix some inconsistencies in
the .deb and .rpm packaging.

This change restricted access to the configuration files (which where
previously readable by all users) but failed to adjust the files
ownership so that the service can access these files.

Ensure the configuration directory and files belong to the root user and
the opensearch-dashboards group

Signed-off-by: Romain Tartière <[email protected]>
@smortex smortex force-pushed the allow-opensearch-dashboard-user-to-read-config branch from 78e8e00 to b866ee5 Compare September 19, 2023 03:04
@peterzhuamazon
Copy link
Member

Hi @smortex ,

We do see OpenSearch rpm/deb test failed to start cluster as well.

Do you need to do the same fix on OpenSearch?

Thanks.

@smortex
Copy link
Contributor Author

smortex commented Sep 19, 2023

@peterzhuamazon the OpenSearch package is fine according to my testing, it already had some config that changed the owner and we kept it unchanged (just changed the permissions)

@peterzhuamazon peterzhuamazon merged commit c988f82 into opensearch-project:main Sep 19, 2023
12 checks passed
@peterzhuamazon
Copy link
Member

@peterzhuamazon the OpenSearch package is fine according to my testing, it already had some config that changed the owner and we kept it unchanged (just changed the permissions)

Thanks @smortex I think it might be a plugin that caused some hiccups in test.
I checked in my local again with latest pkg and it runs.

I will go ahead and merge this. Thanks.

@smortex smortex deleted the allow-opensearch-dashboard-user-to-read-config branch September 19, 2023 06:00
@smortex smortex changed the title Allow opensearch-dashboard user to read its config Fix opensearch-dashboard user's permission to allow reading the service configuration files Sep 19, 2023
peterzhuamazon added a commit to peterzhuamazon/opensearch-build that referenced this pull request Sep 19, 2023
peterzhuamazon pushed a commit to peterzhuamazon/opensearch-build that referenced this pull request Sep 19, 2023
peterzhuamazon pushed a commit to peterzhuamazon/opensearch-build that referenced this pull request Sep 19, 2023
peterzhuamazon pushed a commit to peterzhuamazon/opensearch-build that referenced this pull request Mar 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Development

Successfully merging this pull request may close these issues.

Defaut config permission too relaxed in deb and rpm packages
2 participants