search

freedomofpress / fingerprint-securedrop

A machine learning data analysis pipeline for analyzing website fingerprinting attacks and defenses.
GNU Affero General Public License v3.0
29 stars 9 forks source link

Ensure fpsd group can write to repo logging folder #102

Closed psivesely closed 7 years ago

psivesely commented 7 years ago

Since git only tracks the executable bit of files and it appears that (at least in our production instances) the /opt/fingerprint-securedrop/fpsd/logging folder is ending up with 0755 permissions (if anyone can explain why that would be greatly appreciated--seems like some sort of default) even though we do set /opt/fingerprint-securedrop to 0770 before cloning to that folder. Manual invocation of the sorter (which at this point is only manually run) and crawler require write access to this logging folder.

coveralls commented 7 years ago

Coverage Status

Coverage remained the same at 72.727% when pulling 8c9c468c8f28e2844e367a7ca7261837db0a5bb6 on logging-folder-permissions into d995ae9e4dab92aab202f355669257042723d787 on master.

conorsch commented 7 years ago

To be clear, these changes are setting the group-writable bit so that devs can interactively invoke the crawler. The owner-writable bit already exists (thanks to the 0755 dir mode) and permits the service to run appropriately.

the /opt/fingerprint-securedrop/fpsd/logging folder is ending up with 0755 permissions (if anyone can explain why that would be greatly appreciated--seems like some sort of default)

That's just git honoring the system umask. Only applies when it's creating the directories, i.e. on first clone. From there on out it should preserve modified modes on subdirectories within the repo.

This is fine for merge. The changes are idempotent and do moderately ease the dev workflow for interactive sorter runs, since we don't have a service wired up for that yet.