Repository navigation
fix: a random password for each drill sandbox, kept off the process list (2.10.1) - #60
Merged
Merged
Conversation
…ist (2.10.1) The sandbox holds restored production data. Its port is bound to 127.0.0.1, which every account on the machine can reach, so the fixed password 'drill' protected nothing on a shared machine. Each sandbox now gets 16 random bytes; docker reads the value from its own environment, so it never appears in argv. The skill's by-hand restore test does the same: a password from openssl rand, passed to each command through PGPASSWORD rather than in the URL.
…fore any container starts The CLI's Auth restore refuses a pg_restore without \restrict and an older psql, so a 17.0-17.5 client used to fail only at the restore step, after the backup and drill had run. The skill doc's comment no longer says the password is off the process list, only off docker's arguments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The drill sandbox holds restored production data. Its port is bound to 127.0.0.1, which keeps the network out but not the other accounts on the same machine, and every sandbox used the password
drill. On a shared machine (a multi-user server, a shared CI runner) anyone with a shell account could connect for as long as the sandbox ran, or indefinitely with--keep.What changes
drill: each sandbox gets 16 random bytes as its password. The value reaches docker through its environment (-e POSTGRES_PASSWORDwith no value), so it never appears in argv. The connection string carries it as before; pg_restore and psql already get it throughPGPASSWORD, not argv.--keeptest now checks that the kept sandbox's password is random, that it connects, and thatdrillno longer does.openssl rand -hex 16, passed to docker the same way and to psql/pg_restore as a per-commandPGPASSWORD(exported, it would also replace~/.pgpassfor the production connection).2.10.0image tag pointing at what npm has). Tessl manifest 1.0.1.Nothing changes for users: the password only exists inside the sandbox, and reports are the same. The hosted worker keeps its locked version until its next upgrade.
Not in this PR
The plugin's
npx -y backupdrill@2.10.0pins move to 2.10.1 in a separate PR once 2.10.1 is on npm, as with #44 and #52.Verification
pnpm test: 441 passed, 0 failed (includes the Docker--keeptest with the new assertions).tsc --noEmitclean.drillis rejected,docker inspectshows the env var set, and a taken port printscontainer: not started.