Azure / Azure/azure-linux-extensions
Passphrase file is readable by anyone
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
As mentioned in #497 the problem persists on Ubuntu 20.04 VMs. LinuxPassPhraseFileName is readable by anyone by default
```
$ ls -lAh /mnt/azure_bek_disk/*
-rwxr-xr-x 1 root root 148 Jun 2 10:25 /mnt/azure_bek_disk/CRITICAL_DATA_WARNING_README.txt
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName_1_0
```
fmpov, permission 400 will be more secure.
changing permissions does not seem to have any effect, as its a vfat mounted disk
```
$ sudo chmod -v 400 /mnt/azure_bek_disk/LinuxPassPhraseFileName*
mode of '/mnt/azure_bek_disk/LinuxPassPhraseFileName' changed from 0555 (r-xr-xr-x) to 0400 (r--------)
mode of '/mnt/azure_bek_disk/LinuxPassPhraseFileName_1_0' changed from 0555 (r-xr-xr-x) to 0400 (r--------)
$ ls -lAh /mnt/azure_bek_disk/*
-rwxr-xr-x 1 root root 148 Jun 2 10:25 /mnt/azure_bek_disk/CRITICAL_DATA_WARNING_README.txt
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName
-r-xr-xr-x 1 root root 172 Jun 2 10:25 /mnt/azure_bek_disk/LinuxPassPhraseFileName_1_0
```
Modification of parent read directory and fstab options doesn't seem to have an effect either:
```bash
sudo umount /mnt/azure_bek_disk
sudo chmod -v 700 /mnt/azure_bek_disk/
# now mounting is not possible anymore, so I restarted
```
changed fstab from
```bash
LABEL=BEK\040VOLUME /mnt/azure_bek_disk auto defaults,discard,nofail 0 0
```
to
```bash
LABEL=BEK\040VOLUME /mnt/azure_bek_disk vfat auto,nouser,noexec,ro,uid=0,gid=0,umask=0277 0 0
```
Without any effect
Do you know a workaround for this?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported permissions on an Ubuntu 20.04 VM and inspect how the BEK volume is mounted as vfat. Compare the resulting mount options and file modes with the requested protection, then verify any workaround against LinuxPassPhraseFileName and its versioned copy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- infrastructure, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100