Repository navigation
fix: least privilege and quoting for what reaches root - #59
Merged
Merged
Conversation
- Certificates: operator paths quoted; files staged beside the live ones, key/cert/match/chain checked, then moved (previous kept). - Venv packages: the venv pip runs as the instance user with no login shell; root only passes the requirements file on stdin; pip options refused; commas split only before a package name. - Report reads pyvenv.cfg instead of running the instance interpreter; git runs as the instance user (git refuses root in another user's checkout), and both OCB origin forms are detected. - Neutralisation and copy identity run as the copy's owner role with a fixed search_path, not as the superuser. - Venv replication and wkhtmltopdf use a private mktemp directory; the replication keeps exact name==version lines and fails with pip. - tar runs as the instance user for backups (manual and scheduled) and restores. - Host text is sanitised before it reaches the terminal; typed control characters are refused; typed unit names go after --. - mask covers escaped secrets; the role SQL uses a unique dollar tag; exports are new private files; run(check=True) no longer prints the command. - tools/verify_privilege.py (CI) executes the certificate, download, venv and owner-role neutralisation steps.
…without Odoo tables With search_path pg_catalog, public the current schema was pg_catalog, so no rule found its table and the check passed on nothing. pg_catalog is searched first anyway; the check now fails when the current schema has no ir_cron. Table-existence tests are nested so PL/pgSQL never plans a query on a missing table.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second audit, group B: what reaches a root shell, a superuser session or the terminal. Each fix is checked by running it; the new
tools/verify_privilege.pyruns in CI.babel>=2.14,<3stays one requirement.pyvenv.cfginstead of running the instance's interpreter as root.search_path = public. A trigger in the copy can no longer raise its own role; a negative control proves it does when the step runs as superuser. The check now fails when it sees no Odoo tables. A real Odoo 14/18 run caught this case: with a wrongsearch_path, the check passed while neutralising nothing./tmp: the venv replication and the wkhtmltopdf download use a privatemktemp -d. The replication keeps onlyname==versionlines and fails when pip fails.--, andSECURITY.mdis corrected.Verified:
verify_privilege,verify_data_safetyandverify_secretspass.verify_neutralisationpasses with real Odoo 14 and 18 (52 checks).OpenSpec:
2026-10-08-least-privilege-and-quoting.Assisted-by: Claude