search

bertvv / ansible-role-mariadb

Install MariaDB on RHEL/CentOS 7 or Fedora.
https://galaxy.ansible.com/bertvv/mariadb/
Other
144 stars 108 forks source link

Database initialization can leak database content #4

Closed exploide closed 7 years ago

exploide commented 7 years ago

The database init scripts are copied to /tmp on the target host with no permission mode set. This means that (depending on the umask) the sql files might have mode 644 and hence are readable for everyone. Since these files can contain the entire production database that probably includes sensitive data, it might be wise to restrict read access to root or the Ansible user.

So I propose:

- name: Copy database init scripts
  copy:
    src: "{{ item.script }}"
    dest: "/tmp/{{ item.script|basename }}"
    mode: 0600
  with_items: "{{ mariadb_init_scripts }}"
tags: mariadb

Beside that, if the initial databases are big, they can consume a lot of space available in /tmp. So maybe it is a good idea to delete them after the initialization completed. E.g.:

- name: Remove database init scripts
  file:
    path: "/tmp/{{ item.script|basename }}"
    state: absent
  with_items: "{{ mariadb_init_scripts }}"
tags: mariadb

I decided to open an issue instead of proposing a PR because there is another issue regarding the database initialization where you said you need to restructure it anyway.