appleboy / appleboy/scp-action

Permission inheritance problems

Open
#192 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
1.6k
Forks
178
PR merge metrics
No merged PRs in 30d

Description

this action seems to have some permission & inheritance issues.
for example, setup a directory on a remote machine with this:
```
sudo addgroup group1
adduser githubuser
usermod -aG group1 githubuser
usermod -aG group1 www-data
sudo chown -R :group1 /var/www/
sudo chmod -R 2770 /var/www/
# inherit permissions on created folders & files within dir
setfacl -R -d -m g::rwx /var/www/
```

then, when using:
```
- name: copy file via ssh password
uses: appleboy/scp-action@v0.1.7
with:
host: ${{ secrets.TEST_HOST }}
port: ${{ secrets.TEST_PORT }}
username: ${{ secrets.TEST_USERNAME }}
password: ${{ secrets.TEST_PASSWORD }}
source: "!.git,*"
target: /var/www/
strip_components: 0
overwrite: true
```

so, folders from your repo, after they are copied (through ssh) to remote `/var/www/` dir, the copied folders there are having `2750` permissions, instead of `2770`, causing other group users (eg www-data) being unable to access those file/folders.

so, it's crucial that group permissions were correctly inherited.
any thoughts? thanks

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the supplied GitHub Actions scp-action step against a remote /var/www/ directory configured with setgid and default ACLs, then inspect the action's file-transfer entry point. Done means copied directories and files retain the intended group inheritance, including 2770 permissions so group users such as www-data can access them.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, shell
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.