Feature #29960: Run foreman.service with systemd PrivateTmp=true - Foreman

Feature #29960

Run foreman.service with systemd PrivateTmp=true

Added by Anurag Patel about 1 year ago. Updated 5 months ago.

Status:

Closed

Priority:

High

Assignee:

Evgeni Golov

Category:

Packaging

Target version:

2.4.0

Difficulty:

Triaged:

Yes

Bugzilla link:

1732038

Pull request:

https://github.com/theforeman/foreman/pull/8345, https://github.com/theforeman/foreman/pull/8356, https://github.com/theforeman/foreman/pull/8351

Fixed in Releases:

2.4.0

Found in Releases:

Description

When foreman.service or foreman-proxy.service is started, it creates world-writable directory `/tmp/bundler/home`. Some users have reported that this triggers alarms in their security scans. Daemons that use `PrivateTmp=true` in their Systemd unit files create tmp directories at `/tmp/systemd-private-*-httpd.service-*/` instead with correct directory permissions.

As an example, PrivateTmp=true is the default setting for httpd shipped from RHEL-7 onwards [1].

[1] https://access.redhat.com/blogs/766093/posts/1976243

Related issues

Associated revisions

Revision d56290ba (diff)
Added by Evgeni Golov 5 months ago

Fixes #29960 - set PrivateTmp=true in foreman.service

Revision b260c03d (diff)
Added by Evgeni Golov 5 months ago

Refs #29960 - also set PrivateTmp=true for dynflow-sidekiq

History

#1 Updated by Lukas Zapletal about 1 year ago

Older versions of bundler actually have a security issue with incorrect permissions on that directory allowing arbitrary code execution. I have reported this and it's been fixed :-)