Date: Mon, 07 Jun 2021 20:04:32 +0000 From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 256472] sysutils/zrepl: /var/run/zrepl should not be world-readable Message-ID: <bug-256472-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D256472 Bug ID: 256472 Summary: sysutils/zrepl: /var/run/zrepl should not be world-readable Product: Ports & Packages Version: Latest Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: Individual Port(s) Assignee: lcook@freebsd.org Reporter: raul.munoz@custos.es CC: asomers@FreeBSD.org Flags: maintainer-feedback?(lcook@freebsd.org) Assignee: lcook@freebsd.org CC: From: https://zrepl.github.io/configuration/misc.html#runtime-directories-unix-so= ckets [....] The zrepl daemon needs to open various UNIX sockets in a runtime directory: a control socket that the CLI commands use to interact with the daemon the ssh+stdinserver Transport listener opens one socket per configured client, named after client_identity parameter There is no authentication on these sockets except the UNIX permissions. The zrepl daemon will refuse to bind any of the above sockets in a directory th= at is world-accessible. [....] by default, this control socket is created at /var/run/zrepl 0750 would work, but not 0755 --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-256472-7788>