canonical / canonical/sysbench-operator
sysbench commands should be executed with its own user && review lua scripts permission
- Dominant language
- Python
- Stars
- 2
- Forks
- 1
- Avg merge
- 9h 7m
- Merged PRs (30d)
- 11
Description
There are two things we need to review:
1) Lua scripts uploaded by the charm should be read-only for any users, but only manageable by the charm itself
1.1) Copy the lua scripts to a separate folder that sysbench_svc can access, e.g. /var/lib/sysbench_svc
2) We must downgrade the permissions of sysbench. It must be executed with a `sysbench` user instead of `root`
Maybe consider a sysbench snap instead.
Contributor guide
Research direction
Start by reviewing how the charm uploads Lua scripts and invokes sysbench. Done means the scripts are placed where sysbench_svc can read them while remaining manageable only by the charm, and sysbench commands run as a dedicated non-root user; consider the snap option separately.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, python
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100