kanidm: server.toml and the DB folder are world-readable inside the volume #519

Nytt ärende

Stängd

öppnade 2026-10-02 13:12:53 +00:00 av supernaut · 0 kommentarer

supernaut kommenterad

2026-10-02 13:12:53 +00:00

Ägare

Problem

Every kanidmd database backup (daily and, since #517, hourly) logs three warnings:

/data/server.toml has 'everyone' permission bits in the mode
/data/server.toml owned by the current uid, which may allow file permission changes
DB folder /data has 'everyone' permission bits in the mode

So server.toml and the DB folder inside the Kanidm volume are world-readable or writable from inside the container. The identity database should not be.

Fix

Set server.toml to 0640 or 0600 and the /data folder to 0750 or 0700, as the container user sees them, without fighting podman's ownership mapping (manage the mode, not the owner). Confirm the warnings are gone from the next backup run, and that Kanidm still starts.

Done when

A backup run logs none of the three warnings.

## Problem Every `kanidmd database backup` (daily and, since #517, hourly) logs three warnings: - `/data/server.toml has 'everyone' permission bits in the mode` - `/data/server.toml owned by the current uid, which may allow file permission changes` - `DB folder /data has 'everyone' permission bits in the mode` So `server.toml` and the DB folder inside the Kanidm volume are world-readable or writable from inside the container. The identity database should not be. ## Fix Set `server.toml` to 0640 or 0600 and the `/data` folder to 0750 or 0700, as the container user sees them, without fighting podman's ownership mapping (manage the mode, not the owner). Confirm the warnings are gone from the next backup run, and that Kanidm still starts. ## Done when A backup run logs none of the three warnings.

supernaut lade till etiketterna

area/identity

area/security

ready-for-implementation

type

bug

2026-10-02 13:13:23 +00:00

supernaut lade till detta till projektet Bitborg Infrastructure

2026-10-02 13:13:24 +00:00

supernaut refererade till detta ärende från en incheckning

2026-10-02 16:14:05 +00:00

fix(kanidm): restrict server.toml and the data dir modes