canonical / canonical/sysbench-operator

sysbench commands should be executed with its own user && review lua scripts permission

Open
#32 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
2
Forks
1
Avg merge
9h 7m
Merged PRs (30d)
11

Description

There are two things we need to review:

1) Lua scripts uploaded by the charm should be read-only for any users, but only manageable by the charm itself
1.1) Copy the lua scripts to a separate folder that sysbench_svc can access, e.g. /var/lib/sysbench_svc
2) We must downgrade the permissions of sysbench. It must be executed with a `sysbench` user instead of `root`

Maybe consider a sysbench snap instead.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how the charm uploads Lua scripts and invokes sysbench. Done means the scripts are placed where sysbench_svc can read them while remaining manageable only by the charm, and sysbench commands run as a dedicated non-root user; consider the snap option separately.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, python
Domain
devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.