nextcloud / server

☁️ Nextcloud server, a safe home for all your data
https://nextcloud.com
GNU Affero General Public License v3.0
27.22k stars 4.05k forks source link

[Bug]: security warning for readonly server config #46037

Open danieljkemp opened 4 months ago

danieljkemp commented 4 months ago

⚠️ This issue respects the following points: ⚠️

Bug description

Reopening https://github.com/nextcloud/server/issues/29173, as it is still present in 29.0.2.2

The admin overview page displays a warning if read only config is set to true. This is not an actual security issue, nor does it prevent the application from functioning, it should not be a warning.

I have an upgrade script that manages sets this to false as needed (via a container) so the main processes can have everything mounted read-only, as they should.

instanceid, the application version, and maintenance should also not be set in this way but those are independent issues.

See also: https://github.com/nextcloud/docker/issues/2044

Steps to reproduce

  1. Install Nextcloud with readonly config and start it
  2. Login to Nextcloud and click on Administration / Overview
  3. You get a warning for a valid and good decision in the category "Security & setup warnings"

Expected behavior

This can maybe a informal hint, but it should not be a warning. I would prefer a security hint if the file is writable

Installation method

None

Nextcloud Server version

29

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

joshtrichards commented 2 months ago

This can maybe a informal hint, but it should not be a warning. I would prefer a security hint if the file is writable

We aren't classifying it as an error (red) nor a warning (yellow). It's info message:

https://github.com/nextcloud/server/blob/1a51afd0327d56dd055c932c80803a55ae21fbd1/apps/settings/lib/SetupChecks/ReadOnlyConfig.php#L31-L36

The info hint is there because people set this option then can't figure out why they can't change things, perform updates, etc.

So I guess one of the issues is the heading on the Administration settings->Overview page. :shrug:

Perhaps it's time to change Security & setup warnings to Setup checks or something.

danieljkemp commented 2 months ago

Maybe a warning should popup when trying to select a field that is impacted by this rather than adding noise to setups using read-only configs?