fix(server): harden sandbox TLS secret volume permissions#341
Closed
drew wants to merge 1 commit intoNVIDIA:mainfrom
Closed
fix(server): harden sandbox TLS secret volume permissions#341drew wants to merge 1 commit intoNVIDIA:mainfrom
drew wants to merge 1 commit intoNVIDIA:mainfrom
Conversation
|
Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text: I have read the DCO document and I hereby sign the DCO. You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot. |
Collaborator
|
Closing in favor of consolidated re-implementation. See #350 for tracking. |
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Description
defaultModeto0400(256decimal) for the sandbox TLS secret volume in both the default pod template path and the custom pod-template injection path incrates/openshell-server/src/sandbox/mod.rs./etc/openshell-tls/client/*so runtime behavior remains unchanged.tls_secret_volume_uses_owner_read_only_modeasserting the injected TLS secret usesdefaultMode: 256.cargo fmt --allto keep formatting consistent.Testing
cargo test -p openshell-server tls_which executed the added unit test plus related TLS tests and integration cases, and all ran successfully (unit tests passed and integration TLS tests succeeded).cargo fmt --allwhich completed without changes/errors.mise run pre-commitbut it failed in this environment due to external tool/version resolution and network/trust issues, so pre-commit automation could not be validated here.Codex Task