Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
FS#70145 - [prometheus] /var/lib/prometheus should not be world readable
Attached to Project:
Arch Linux
Opened by Jakub Klinkovský (lahwaacz) - Wednesday, 24 March 2021, 08:43 GMT
Last edited by Jelle van der Waa (jelly) - Monday, 20 September 2021, 07:36 GMT
Opened by Jakub Klinkovský (lahwaacz) - Wednesday, 24 March 2021, 08:43 GMT
Last edited by Jelle van der Waa (jelly) - Monday, 20 September 2021, 07:36 GMT
|
Details/var/lib/prometheus is created as 755 (world readable) in the PKGBUILD and Prometheus creates the files/directories with the default umask. Metrics aren't secrets, but I don't think they should be world readable.
See also https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/289 |
This task depends upon
Closed by Jelle van der Waa (jelly)
Monday, 20 September 2021, 07:36 GMT
Reason for closing: Fixed
Additional comments about closing: prometheus-2.30.0-1-x86_64.pkg.tar.zst
Monday, 20 September 2021, 07:36 GMT
Reason for closing: Fixed
Additional comments about closing: prometheus-2.30.0-1-x86_64.pkg.tar.zst