Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove sudo dependency #18

Open
daniil-berg opened this issue Sep 13, 2024 · 0 comments
Open

Remove sudo dependency #18

daniil-berg opened this issue Sep 13, 2024 · 0 comments
Assignees
Labels
breaking change Changes to public functions that are not backwards compatible dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation

Comments

@daniil-berg
Copy link
Contributor

To somewhat mitigate the potential security vulnerability that comes from running third-party programs like ffmpeg as sub-processes, we currently provide the check_user config option that makes Videbo launch those sub-processes with sudo -u <check_user> <command>.

This is not a particularly elegant way to solve the underlying issue and forces Videbo to rely specifically on sudo as a dependency for this functionality.

There are different sandboxing tools out there (e.g. Bubblewrap) that could be used to run those programs more safely and we should leave the choice to the user.

The entire check_user logic and the config option should be removed. sudo should be removed as requirement from the documentation. Instead a working example configuration with something like Bubblewrap should be provided to demonstrate how a more secure setup could look.

@daniil-berg daniil-berg self-assigned this Sep 13, 2024
@daniil-berg daniil-berg added documentation Improvements or additions to documentation dependencies Pull requests that update a dependency file breaking change Changes to public functions that are not backwards compatible labels Sep 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking change Changes to public functions that are not backwards compatible dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation
Projects
None yet
Development

No branches or pull requests

1 participant