fluxcd/pkg exposes an fs_secure module, which allows restricting which file paths the consumers have access to. I did some digging through the codebase and it's only currently used by flux install and flux bootstrap.
Use of the fs_secure module was adopted in the logic for the flux build kustomization --in-memory-build, which unexpectedly broke when combined with --path, as it locks to CWD. This combination breaking was reported in #5968 and the memory-build disabled as a default in #5969. The underlying issue of if/where to lock wasn't addressed however, so the flag is still broken when used with --path.
Assuming we'd want to consistently use the secure access pattern, this would mean restricting flux build kustomization. The flux install and flux bootstrap commands seem to lock to a tempdir and/or Git root, so no direct equivalent unfortunately... As a proposal, looking up the following values would make sense to me:
- locking to --path if present
- or Git root if present
- or $CWD as final fallback
If a change to the current behaviour (no lock for building) isn't desired, the --in-memory-build logic still needs to be relaxed to match.
I already implemented the easy "relax in-memory build" fix a few weeks ago in #5974, but I can also imagine that implementing a consistent secure access logic would be preferable instead. It came up in the PR/issue discussions a couple times so might be valuable to pin down the desired behavior. Happy to look at implementing it in any case!
fluxcd/pkgexposes anfs_securemodule, which allows restricting which file paths the consumers have access to. I did some digging through the codebase and it's only currently used byflux installandflux bootstrap.Use of the
fs_securemodule was adopted in the logic for theflux build kustomization --in-memory-build, which unexpectedly broke when combined with--path, as it locks to CWD. This combination breaking was reported in #5968 and the memory-build disabled as a default in #5969. The underlying issue of if/where to lock wasn't addressed however, so the flag is still broken when used with--path.Assuming we'd want to consistently use the secure access pattern, this would mean restricting
flux build kustomization. Theflux installandflux bootstrapcommands seem to lock to a tempdir and/or Git root, so no direct equivalent unfortunately... As a proposal, looking up the following values would make sense to me:If a change to the current behaviour (no lock for building) isn't desired, the
--in-memory-buildlogic still needs to be relaxed to match.I already implemented the easy "relax in-memory build" fix a few weeks ago in #5974, but I can also imagine that implementing a consistent secure access logic would be preferable instead. It came up in the PR/issue discussions a couple times so might be valuable to pin down the desired behavior. Happy to look at implementing it in any case!