The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-14 11:06:13 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(proxy): drop 0644 token fallback; chown 0600 (tunnel-init runs as root)

Browse Source 
The archivebox image starts as root (privilege drop happens in its entrypoint,
which tunnel-init overrides), so chown to the cloudflared uid always succeeds and
the world-readable 0644 fallback was dead code that could leak the token. Always
write the connector token owned by 65532:65532 with 0600.
This commit is contained in:
archivebox 2026-06-05 00:04:37 +00:00
parent d719fb6916
commit fc7011d988
No known key found for this signature in database
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docker-compose.yml
View File

@ -150,8 +150,8 @@ services:
tok = call("GET", f"/accounts/{acct}/cfd_tunnel/{tid}/token")["result"]
os.makedirs(os.path.dirname(OUT) or ".", exist_ok=True)
with open(OUT, "w") as f: f.write(tok)
try: os.chown(OUT, 65532, 65532); os.chmod(OUT, 0o600) # own it by the cloudflared (uid 65532) reader, keep private
except PermissionError: os.chmod(OUT, 0o644) # tunnel-init not root: stay readable to the connector
os.chown(OUT, 65532, 65532) # tunnel-init runs as root; own the token by the cloudflared (uid 65532) reader
os.chmod(OUT, 0o600) # private: never world-readable on the host bind-mount
print(f"[tunnel-init] {NAME} ({tid}): *.{DOMAIN} + {DOMAIN} -> {SERVICE}; connector token -> {OUT}")
cloudflared: