I understand that for the purpose what it is supposed to be doing it has
to has quite some capabilities. But essentially it is an externally
controlled data (that you mount to a known place) that is then executed

I see that you have set the dependency to a "Requires" already which is good to 
only do that once the mount has worked. But I wonder if we should try to make 
this a bit more secure.
Also you chmod the path - all helpful to avoid people shoving other content 
there that is then executed.
But I was wondering if you happen to have a defined set of "things this agent 
will do". If so it would be great if it could use other users, 
private-directories and reduced capabilities limited to just the amount it 
needs. That would further restrict the potential mis-use.

I've seen you had a security pre-review already and Mike was fine, never
the less I'd appreciate if you could consider further confinement for
this in the long run.

You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

  [MIR] lxd-agent-loader

To manage notifications about this bug go to:

ubuntu-bugs mailing list

Reply via email to