[Bug 256472] sysutils/zrepl: /var/run/zrepl should not be world-readable

From: <bugzilla-noreply_at_freebsd.org>
Date: Mon, 07 Jun 2021 20:04:32 +0000

            Bug ID: 256472
           Summary: sysutils/zrepl: /var/run/zrepl should not be
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: lcook_at_freebsd.org
          Reporter: raul.munoz_at_custos.es
                CC: asomers_at_FreeBSD.org
             Flags: maintainer-feedback?(lcook_at_freebsd.org)
          Assignee: lcook_at_freebsd.org


The zrepl daemon needs to open various UNIX sockets in a runtime directory:

    a control socket that the CLI commands use to interact with the daemon
    the ssh+stdinserver Transport listener opens one socket per configured
client, named after client_identity parameter

There is no authentication on these sockets except the UNIX permissions. The
zrepl daemon will refuse to bind any of the above sockets in a directory that
is world-accessible.

by default, this control socket is created at /var/run/zrepl
0750 would work, but not 0755

You are receiving this mail because:
You are the assignee for the bug.
Received on Mon Jun 07 2021 - 20:04:32 UTC

Original text of this message