docker/compose: keep auth secrets root-only in cert fixer #3041

Closed

mfreeman451 wants to merge 1 commit from refs/pull/3041/head into main

mfreeman451 commented

2026-03-12 20:32:18 +00:00

(Migrated from github.com)

Owner

Imported from GitHub pull request.

Original GitHub pull request: #3030
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/3030
Original created: 2026-03-12T20:32:18Z
Original updated: 2026-03-12T20:40:20Z
Original head: carverauto/serviceradar:codex/propose-fix-for-cert-permissions-vulnerability
Original base: main

Motivation

A recent change made docker/compose/fix-cert-permissions.sh recursively chown the shared cert volume to the runtime UID/GID, which together with docker/compose/update-config.sh writing jwt-secret/api-key/admin password files into the same directory exposed authentication secrets to poller/agent containers mounting the volume read-only.

Description

Add a minimal hardening to docker/compose/fix-cert-permissions.sh that, after normalizing cert/key permissions, explicitly resets high-value non-certificate secret files (jwt-secret, api-key, admin-password, admin-password-hash, password.txt, edge-onboarding.key) to root:root and chmod 600, preserving certificate sharing for mTLS while preventing runtime service UIDs from reading bootstrap/auth secrets.

Testing

Performed a shell syntax check with sh -n docker/compose/fix-cert-permissions.sh, which completed without errors.

Codex Task

Imported from GitHub pull request. Original GitHub pull request: #3030 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/pull/3030 Original created: 2026-03-12T20:32:18Z Original updated: 2026-03-12T20:40:20Z Original head: carverauto/serviceradar:codex/propose-fix-for-cert-permissions-vulnerability Original base: main --- ### Motivation - A recent change made `docker/compose/fix-cert-permissions.sh` recursively `chown` the shared cert volume to the runtime UID/GID, which together with `docker/compose/update-config.sh` writing `jwt-secret`/`api-key`/admin password files into the same directory exposed authentication secrets to poller/agent containers mounting the volume read-only. ### Description - Add a minimal hardening to `docker/compose/fix-cert-permissions.sh` that, after normalizing cert/key permissions, explicitly resets high-value non-certificate secret files (`jwt-secret`, `api-key`, `admin-password`, `admin-password-hash`, `password.txt`, `edge-onboarding.key`) to `root:root` and `chmod 600`, preserving certificate sharing for mTLS while preventing runtime service UIDs from reading bootstrap/auth secrets. ### Testing - Performed a shell syntax check with `sh -n docker/compose/fix-cert-permissions.sh`, which completed without errors. ------ [Codex Task](https://chatgpt.com/codex/tasks/task_e_69b1fd25da188320ad6d26562ceeb9a1)

mfreeman451 commented

2026-03-12 20:40:14 +00:00

(Migrated from github.com)

Author

Owner

Imported GitHub PR comment.

Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/3030#issuecomment-4049891634
Original created: 2026-03-12T20:40:14Z

closing, we have a better fix in another branch

Imported GitHub PR comment. Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/pull/3030#issuecomment-4049891634 Original created: 2026-03-12T20:40:14Z --- closing, we have a better fix in another branch