gsadmin/garage
1
0
Fork 0
mirror of https://github.com/deuxfleurs-org/garage.git synced 2026-08-27 23:47:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add allow_world_readable_secrets option to config file

Browse Source 
Sometimes, the secret files permissions checks gets in the way. It's
by no mean complete, it doesn't take the Posix ACLs into account among
other things. Correctly checking the ACLs would be too involving (see
https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/658#issuecomment-7102)
and would likely still fail in some weird chmod settings.

We're adding a new configuration file key allowing the user to disable
this permission check altogether.

The (already existing) env variable counterpart always take precedence
to this config file option. That's useful in cases where the
configuration file is static and cannot be easily altered.

Fixes https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/658

Co-authored-by: Florian Klink <flokli@flokli.de>
This commit is contained in:
Félix Baylac Jacqué
2023-10-25 11:34:39 +02:00
parent 4b3dee2ca3
commit f83fa02193
2 changed files with 89 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/book/reference-manual/configuration.md
+12
View File
@@ -323,6 +323,18 @@ be obtained by running `garage node id` and then included directly in the
key will be returned by `garage node id` and you will have to add the IP
yourself.
### `allow_world_readable_secrets`
Garage checks the permissions of your secret files to make sure
they're not world-readable. In some cases, the check might fail and
consider your files as world-readable even if they're not. Such as
when using Posix ACLs.
Setting `allow_world_readable_secrets` to `true` bypass this
permission verification.
Alternatively, you can set the `GARAGE_ALLOW_WORLD_READABLE_SECRETS`
environment variable to `true` to bypass the permissions check.
## The `[consul_discovery]` section