fix(kanidm): restrict server.toml and the data dir modes #522

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/519-kanidm-perms in i main

2026-10-02 16:44:51 +00:00

supernaut kommenterad

2026-10-02 16:14:49 +00:00

Ägare

What

Restrict Kanidm's config and data dir modes.

server.toml (host file bind-mounted at /data/server.toml): 0644 → 0600. Kanidm runs as container root, which maps to the file's owner.
Kanidm volume root (/data in the container): 755 → 0750, via file with mode only and no owner, so it does not fight podman's uid mapping. The mountpoint comes from a read-only podman volume inspect.

Live modes before were read with podman unshare stat (read-only).

Apply

Kanidm restarts once (the template change notifies the handler). Later applies report ok. After the apply, the next backup's kanidmd database backup should no longer warn about "everyone" permission bits. The "owned by the current uid" warning stays and is expected.

Closes #519

## What Restrict Kanidm's config and data dir modes. - `server.toml` (host file bind-mounted at `/data/server.toml`): 0644 → 0600. Kanidm runs as container root, which maps to the file's owner. - Kanidm volume root (`/data` in the container): 755 → 0750, via `file` with mode only and no owner, so it does not fight podman's uid mapping. The mountpoint comes from a read-only `podman volume inspect`. Live modes before were read with `podman unshare stat` (read-only). ## Apply Kanidm restarts once (the template change notifies the handler). Later applies report `ok`. After the apply, the next backup's `kanidmd database backup` should no longer warn about "everyone" permission bits. The "owned by the current uid" warning stays and is expected. Closes #519

supernaut lade till 1 incheckning

2026-10-02 16:14:49 +00:00

fix(kanidm): restrict server.toml and the data dir modes

ci / ci (pull_request) Successful in 1m57s

Detaljer

336bac83d7