-
Notifications
You must be signed in to change notification settings - Fork 128
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixed security issue with config file #33
base: develop
Are you sure you want to change the base?
Fixed security issue with config file #33
Conversation
@jkellerer I know it's been a while, but could you rebase against |
f0bda18
to
a16decf
Compare
@Fmstrat , rebase is done |
a16decf
to
4adf67a
Compare
I'm not sure what security implication this has from reviewing it, but I do see you've replaced logs with |
The security implications are listed in the description of the PR. It was about not specifying the config file in the call which means supervisor will search at default locations and use some files provided by the distribution. E.g. they enable remote control which is something not needed for this case. Regarding log redirection, yes I agree, it should not be sent to a file at all. I can update this part. |
@Fmstrat, log output should now only be stdout or err (no files). I had added env var |
ae3815d
to
612b472
Compare
This PR fixes a security issue with
supervisord
(is logged when used in latest Ubuntu releases).Resolved problems:
supervisord
from searching for config files at standard paths by specifying the config to use.supervisord
that running as root is intended and no warning must be logged (after fixing the issues).