Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mount entrypoint volume as read-only. #4242

Merged
merged 1 commit into from
Sep 18, 2021
Merged

Mount entrypoint volume as read-only. #4242

merged 1 commit into from
Sep 18, 2021

Conversation

wlynch
Copy link
Member

@wlynch wlynch commented Sep 17, 2021 •
edited
Loading

Changes

This change makes the entrypoint binary volume read-only by separating the
/tekton/tools directory:

  • /tekton/bin - Mounted as RW by the place-tools init container, and RO
    for all user steps. This directory will hold Tekton provided binaries (i.e.
    entrypoint).

  • /tekton/run - Named after Linux's /run directory
    (https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard). This
    directory will hold Tekton runtime data (i.e. step post/wait files).

This is being done as an extra layer of security to prevent any tampering
of Tekton provided tools. This is similar in spirit to
89a6233 (making the scripts directory
read-only).

/tekton/tools was considered an internal directory, so this change is not bound to
API compatibility/deprecation policies. This change should have no
affect on the user API surface.

This change does not try to address any issues with the shared post/wait
file volume - this will be handled in another change.

/kind cleanup

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

  • Docs included if any changes are user facing
  • Tests included if any functionality added or changed
  • Follows the commit message standard
  • Meets the Tekton contributor standards (including
    functionality, content, code)
  • Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

/release-note-none

This is an internal-only change.

Part of #4227

@tekton-robot tekton-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Sep 17, 2021
@tekton-robot tekton-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Sep 17, 2021
@wlynch
Copy link
Member Author

wlynch commented Sep 17, 2021

/cc @06kellyjac

@tekton-robot
Copy link
Collaborator

@wlynch: GitHub didn't allow me to request PR reviews from the following users: 06kellyjac.

Note that only tektoncd members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @06kellyjac

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
internal/builder/v1beta1/container.go 91.7% 89.2% -2.5

@wlynch
Copy link
Member Author

wlynch commented Sep 17, 2021

/release-note-none

@tekton-robot tekton-robot added release-note-none Denotes a PR that doesnt merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Sep 17, 2021
@wlynch
Mount entrypoint volume as read-only.
dd93d52 
This change makes the entrypoint binary read-only by separating the
/tekton/tools directory:

- /tekton/bin - Mounted as RW by the place-tools init container, and RO
for all user steps. This directory will hold Tekton provided binaries (i.e.
entrypoint).

- /tekton/run - Named after Linux's /run directory
(https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard). This
directory will hold Tekton runtime data (i.e. step post/wait files).

This is being done as an extra layer of security to prevent any tampering
of Tekton provided tools. This is similar in spirit to
89a6233 (making the scripts directory
read-only).

/tekton/tools was considered an internal directory, so this change is not bound to
API compatibility/deprecation policies. This change should have no
affect on the user API surface.

This change does not try to address any issues with the shared post/wait
file volume - this will be handled in another change.
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
internal/builder/v1beta1/container.go 91.7% 89.2% -2.5

imjasonh
imjasonh approved these changes Sep 17, 2021
View reviewed changes
Copy link
Member

@imjasonh imjasonh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! ❤️

@tekton-robot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: imjasonh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 17, 2021
@dlorenc
Copy link
Contributor

dlorenc commented Sep 18, 2021

/lgtm

Thanks!

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 18, 2021
@tekton-robot tekton-robot merged commit 0fcdd39 into tektoncd:main Sep 18, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@imjasonh imjasonh imjasonh approved these changes

@afrittoli afrittoli Awaiting requested review from afrittoli

@jerop jerop Awaiting requested review from jerop

Assignees

@dlorenc dlorenc

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesnt merit a release note. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@wlynch @tekton-robot @dlorenc @imjasonh