gaia-pipeline/gaia

Set pipeline binary OS permissions accordingly

Closed this issue · 0 comments

Pipelines build by Gaia are automatically copied to the pipelines folder with 0766 permissions. For example: https://github.com/gaia-pipeline/gaia/blob/master/workers/pipeline/build_cpp.go#L92

In my opinion, this is currently not "least privilege" since only the current user needs access rights and not the whole group + everyone else.

The proposed solution is to change this to 0700. This allows the current user to execute, read and write (e.g. delete) the pipeline.