fedora-infra/datanommer

insecure temp database

Closed this issue · 7 comments

tyll commented

datanommer uses /tmp/datanommer.db as default database and is enabled by default in Fedora 19. This might lead to security problems.

ralphbean commented

Any idea what alternative we should use?

We could use postgres by default... too heavyweight.

Disable datanommer by default.. ?

Use a more secure location for the default sqlite db? Any recommendations on where that should be?

tyll commented

It should be disabled by default and a good default location would be /var/lib/datanommer/datanommer.sqlite or similar.

tyll commented

Since the current solution will be cleared is not persistent and will be removed on reboot, the in memory database might be a different option. Or datanommer could just refuse to start unless database was specified.

tyll commented

btw. it also seems that datanommer will not even run out of the box, because there were tracebacks in the fedmsg-hub output when I accidently started it.

ralphbean commented

Ah, can you file another issue with those tracebacks?

ralphbean commented

@tyll, can you comment on #57 and confirm that that will do the trick?