bootc-dev / bootc-dev/bootc

lint: Check for potential uid drift for files in `/etc`

Open
#1,562 2 comments 0 reactions 0 assignees View on GitHub
area/container-lint enhancement
Dominant language
Rust
Stars
2.3k
Forks
230
Avg merge
3d 12h
Merged PRs (30d)
38

Description

Now that we have parsers for both `tmpfiles.d` and `sysusers.d`, we can detect the case where files in `/etc` are owned by a floating uid/gid and warn.

However we should *not* warn if there's a tmpfiles.d entry which does a chown, which is a standard workaround for components/packages which have floating uid/gids; e.g. we shouldn't warn on if we detect
`/usr/lib/tmpfiles.d/polkit.conf:Z /etc/polkit-1/localauthority - polkitd polkitd`

(Humm actually this is tangential but it seems that rpm-ostree auto-synthesized
```
cat /usr/lib/tmpfiles.d/polkit-tmpfiles.conf
d /etc/polkit-1/rules.d 0750 root polkitd - -
```
which seems kind of wrong because it should actually be `Z` here probably)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.