You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "yaalsn (via GitHub)" <gi...@apache.org> on 2023/08/29 10:23:19 UTC
[GitHub] [pulsar] yaalsn opened a new pull request, #21084: [improve][sec] Add group pulsar and add user pulsar to it instead of root
yaalsn opened a new pull request, #21084:
URL: https://github.com/apache/pulsar/pull/21084
### Motivation
Currently, the user pulsar is in the root group, it would be better to use the non-root group to keep more safety.
### Modifications
- Add group pulsar (GID 10000)
- Add user pulsar (UID 10000) to group pulsar
### Verifying this change
- [x] Make sure that the change passes the CI checks.
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1749877224
The pr had no activity for 30 days, mark with Stale label.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Technoboy- closed pull request #21084: [improve][sec] Add group pulsar and add user pulsar to it instead of root
Posted by "Technoboy- (via GitHub)" <gi...@apache.org>.
Technoboy- closed pull request #21084: [improve][sec] Add group pulsar and add user pulsar to it instead of root
URL: https://github.com/apache/pulsar/pull/21084
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1843995912
## [Codecov](https://app.codecov.io/gh/apache/pulsar/pull/21084?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
> Merging [#21084](https://app.codecov.io/gh/apache/pulsar/pull/21084?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (e89bd3e) into [master](https://app.codecov.io/gh/apache/pulsar/commit/d099ac4fa2f217b9c5f0a5e660c83048e829c5d7?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) (d099ac4) will **increase** coverage by `31.55%`.
> Report is 273 commits behind head on master.
> The diff coverage is `n/a`.
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/pulsar/pull/21084?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## master #21084 +/- ##
=============================================
+ Coverage 36.79% 68.34% +31.55%
- Complexity 12223 32188 +19965
=============================================
Files 1698 1881 +183
Lines 130168 162542 +32374
Branches 14206 19987 +5781
=============================================
+ Hits 47890 111095 +63205
+ Misses 75951 42470 -33481
- Partials 6327 8977 +2650
```
| [Flag](https://app.codecov.io/gh/apache/pulsar/pull/21084/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [inttests](https://app.codecov.io/gh/apache/pulsar/pull/21084/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `24.17% <ø> (+0.04%)` | :arrow_up: |
| [systests](https://app.codecov.io/gh/apache/pulsar/pull/21084/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unittests](https://app.codecov.io/gh/apache/pulsar/pull/21084/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `68.61% <ø> (+36.55%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
[see 1505 files with indirect coverage changes](https://app.codecov.io/gh/apache/pulsar/pull/21084/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "yaalsn (via GitHub)" <gi...@apache.org>.
yaalsn commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1853069662
@michaeljmarshall Sorry, I should disscuss more.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "michaeljmarshall (via GitHub)" <gi...@apache.org>.
michaeljmarshall commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1846535442
Why did we merge this without addressing my questions on the mailing list?
https://lists.apache.org/thread/34t3npt0368hppv1gk8wc808ofl786j3
I appreciate that you brought this to the mailing list @yaalsn, but we should not have merged this when there was active opposition and open questions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "zymap (via GitHub)" <gi...@apache.org>.
zymap commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1843991639
Failed to build the image:
```
Failed to execute goal io.fabric8:docker-maven-plugin:0.43.3:build (default) on project latest-version-image: Unable to build image [apachepulsar/pulsar-test-latest-version] : "The command '/bin/sh -c adduser -u 10000 --gid 0 --disabled-login --disabled-password --gecos '' pulsar' returned a non-zero code: 1" -> [Help 1]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "zymap (via GitHub)" <gi...@apache.org>.
zymap merged PR #21084:
URL: https://github.com/apache/pulsar/pull/21084
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1845982713
This PR #13376 provides more context and the reference about why root group must be used for OpenShift support:
* https://engineering.bitnami.com/articles/running-non-root-containers-on-openshift.html
* https://cloud.redhat.com/blog/a-guide-to-openshift-and-uids
> The Container user is always a member of the root group, so it can read or write files accessible by GID=0. Any command invoked by the Entrypoint will be executed with this unprivileged UID and GID pair. That means, it is an unprivileged user executing the commands and the UID that will be used during execution is not known in advance. From the technical design perspective, that means, directories and files that may be written to by processes in the Container should be owned by the root group and be read/writable by GID=0. Files to be executed should also have group execute permissions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "zymap (via GitHub)" <gi...@apache.org>.
zymap closed pull request #21084: [improve][sec] Add group pulsar and add user pulsar to it instead of root
URL: https://github.com/apache/pulsar/pull/21084
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [improve][sec] Add group pulsar and add user pulsar to it instead of root [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #21084:
URL: https://github.com/apache/pulsar/pull/21084#issuecomment-1845972457
> Currently, the user pulsar is in the root group, it would be better to use the non-root group to keep more safety.
I think we need to revert and first do a PIP if we are doing this change. This change will break Openshift support. I'll provide more details as a follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org