Skip to content

db: only chmod a database credentials file that is a regular file #253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MickLesk merged 4 commits into from
Nov 13, 2026
Merged

db: only chmod a database credentials file that is a regular file #253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a4f6e24
Generate database passwords with random_password
MickLesk Nov 12, 2026
bb80554
Keep the database helpers' credentials files private
MickLesk Nov 12, 2026
ddc029d
Only chmod a database credentials file that is a regular file
MickLesk Nov 13, 2026
a3eee5f
Merge remote-tracking branch 'origin/main' into fix/db-helper-passwords
Copilot Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions lib/db.func
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -458,7 +458,7 @@ setup_mariadb_db() {
echo "User: $MARIADB_DB_USER"
echo "Password: $MARIADB_DB_PASS"
} >>"$CREDS_FILE"
chmod 600 "$CREDS_FILE"
[[ -f "$CREDS_FILE" ]] && chmod 600 "$CREDS_FILE"

msg_ok "Set up MariaDB Database"

Expand Down Expand Up @@ -515,7 +515,7 @@ setup_mysql_db() {
echo "User: $MYSQL_DB_USER"
echo "Password: $MYSQL_DB_PASS"
} >>"$CREDS_FILE"
chmod 600 "$CREDS_FILE"
[[ -f "$CREDS_FILE" ]] && chmod 600 "$CREDS_FILE"

msg_ok "Set up MySQL Database"

Expand Down Expand Up @@ -1584,7 +1584,7 @@ setup_postgresql_db() {
echo "User: $PG_DB_USER"
echo "Password: $PG_DB_PASS"
} >>"$CREDS_FILE"
chmod 600 "$CREDS_FILE"
[[ -f "$CREDS_FILE" ]] && chmod 600 "$CREDS_FILE"

msg_ok "Set up PostgreSQL Database"

Expand Down
13 changes: 13 additions & 0 deletions tests/db-helper-context.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,5 +57,18 @@ for db in postgresql mariadb mysql; do
check "$db: runs without APPLICATION, alphanumeric password, creds named after APP and private" "alnum24 pgadmin.creds 600" "$(umask 022; run "$db")"
done

# Scripts suppress the file with PG_DB_CREDS_FILE=/dev/null; chmod 600 on it would
# lock every non-root process out of /dev/null.
devnull_chmods() {
(
chmod() { echo "chmod $*" >>"$TEST_DIR/chmod.log"; }
HOME="$TEST_DIR"
APP="demo"
PG_DB_NAME=appdb PG_DB_USER=appuser PG_DB_CREDS_FILE=/dev/null setup_postgresql_db >/dev/null 2>&1
)
grep -c '/dev/null' "$TEST_DIR/chmod.log" 2>/dev/null || echo 0
}
check "PG_DB_CREDS_FILE=/dev/null is never chmodded" "0" "$(devnull_chmods)"

echo "${passed} passed, ${failed} failed"
[[ "$failed" -eq 0 ]]
Loading