administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-13 10:12:47 +03:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

harden root writes into unprivileged-owned paths

Browse Source 
Restrict the sweep sentinel to a mount at or below /media/frigate so a
parent /media mount cannot bless a later-shadowed volume. Rebuild
/tmp/nginx root-owned each start so root's cp and tempio writes cannot
follow a symlink an unprivileged nginx planted in the previous run.
This commit is contained in:
Josh Hawkins
2026-08-29 15:59:23 -05:00
parent 17b37a08a9
commit bc62eb4adc
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run
+5 -1
View File
@@ -156,8 +156,12 @@ if [[ "$(id -u)" -eq 0 ]]; then
# Only record the sentinel when something is mounted under /media: a
# sweep blessed against the container-local dir created below would let
# a volume attached later skip the sweep forever
# Only bless the sentinel when persistent storage actually backs
# /media/frigate, i.e. a mount at that exact path or below it. A mount
# at the /media parent does not count: a dedicated /media/frigate volume
# added later would shadow the swept directory and be skipped forever.
sentinel_args=(--sentinel /config/.permissions_version)
if ! awk '$2 == "/media" || $2 == "/media/frigate" || $2 ~ /^\/media\/frigate\//' /proc/mounts | grep -q .; then
if ! awk '$2 == "/media/frigate" || $2 ~ /^\/media\/frigate\//' /proc/mounts | grep -q .; then
sentinel_args=()
fi
/usr/local/bin/fix-ownership "${sentinel_args[@]}" \