hellt / vrnetlab

Make VM-based Network OSes run in Containerlab
https://containerlab.dev
MIT License
129 stars 88 forks source link

run SR OS tftp server as a root user #189

Closed hellt closed 7 months ago

hellt commented 7 months ago

A dirty workaround for potential permissions issue rooted in the fact that originally tftp server that hosts the SR OS config was run by the tftp user wity uid/gid = 103/106.

This caused access issues on some installations where SR OS was not able to save the config due to permissions error -- more in this discord thread. It appears to be that the issue is amplifed by the File ACLs added in containerlab some time ago.

The file ACLs for the tftboot dir are as follows:

root@sros:/# getfacl /tftpboot/
getfacl: Removing leading '/' from absolute path names
# file: tftpboot/
# owner: root
# group: root
user::rwx
user:1000:rwx
group::r-x
group:1000:r-x
mask::rwx
other::rwx
default:user::rwx
default:user:1000:rwx
default:group::r-x
default:group:1000:r-x
default:mask::rwx
default:other::r-x

It is not clear why these facls were a problem for some deployments, as I couldn't reproduce it on my VMs.

As a quick workaround the user has been changed from the tftp to root in the tftp server launch command, this should prevent potential access issues.