search

coder / code-server

VS Code in the browser
https://coder.com
MIT License
67.27k stars 5.51k forks source link

[Feat]: In code-server，How to restrict users to only access files within the workspace directory #6658

Closed isatis-summer closed 6 months ago

isatis-summer commented 6 months ago

image

In code-server, restrict users to only access files within the workspace directory. For example, if the set directory is /home/workspace, users are currently able to access the /home folder or even the root directory (/), which allows access to the entire container's directories. This poses a security risk.

code-asher commented 6 months ago

Thank you for the suggestion!

We could restrict the file picker to the workspace root(s), and do the same with the "open file" picker, but this would not really close any security holes as the user will still have access to the files through the command line, extensions, and the debugger.

I think the only way to reliably achieve this is to use a chroot or run code-server in a VM/container. It sounds like you are already running in a container though and I assume you have users and permissions on the directories set up correctly, so is there actually a security risk here?

Duplicate of https://github.com/coder/code-server/issues/600

repo-ranger[bot] commented 6 months ago

⚠️ This issue has been marked duplicate and will be closed in 2 days.