Project

General

Profile

Actions
Copy link

Idea #22940

open

Deploy core services with an arvados group

Added by Brett Smith 10 months ago.

Status:
New
Priority:
Normal
Assigned To:
-
Category:
Deployment
Target version:
-
Start date:
Due date:
Story points:
-

Description

Basic idea:

  1. At some low level, we ship /usr/lib/sysusers.d/arvados.conf with:
    g arvados -
    See sysusers.d
  2. We arrange for /etc/arvados to be 0755 root:arvados and /etc/arvados/config.yml to be 0640 root:arvados.
  3. Services that need to read the cluster configuration declare SupplementaryGroups=arvados in their unit definitions.

This lets us run all services as non-root, or ideally with DynamicUser, while retaining secure, read-only access to the cluster configuration.

Related issues 2 (2 open — 0 closed)

Related to Arvados - Idea #22941: arvados-server package replaces all of its clonesNewActions
Related to Arvados - Support #22799: Review security hardening of systemd units used for servicesNewActions
Actions
Copy link
 #1

Updated by Brett Smith 10 months ago

  • Related to Idea #22941: arvados-server package replaces all of its clones added
Actions
Copy link
 #2

Updated by Brett Smith 10 months ago

  • Related to Support #22799: Review security hardening of systemd units used for services added
Actions
Copy link

Also available in: Atom PDF