cockroachdb / cockroachdb/cockroach
jobs: ensure jobs execute using permissions of creator instead of root
Open
C-enhancement
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
As a follow up to the CDC pre-mortem: https://docs.google.com/document/d/1X2D64G_Jdb9S4MxrBYPH_fwKAP3dkUrhc7yUgZZNZAY/edit#
We're worried about a security vulnerability caused by introduced by the way jobs are executed partly as root/system instead of by the user. We should add testing/investigate to ensure that jobs execute using permissions of creator instead of root.
Jira issue: CRDB-26973
Contributor guide
Assessment
This issue has not been assessed yet.