Maniphest T103095

Confine Graphoid with firejail
Closed, ResolvedPublic
Actions

Assigned To

MoritzMuehlenhoff

Authored By

	• mobrovac
	Jun 19 2015, 1:40 PM

Tags

Referenced Files

None

Subscribers

Description

The Graphoid instances running in production should be locked down as much as possible to avoid possible security issues caused by various penetration techniques. To that end, it should be firejail-ed.

Details

	Project	Branch	Lines +/-	Subject
	operations/puppet	production	+1 -1	Enable firejail for graphoid

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		MoritzMuehlenhoff	T101870 Service containment for nodejs-based services with firejail
		Resolved		MoritzMuehlenhoff	T103095 Confine Graphoid with firejail
		Resolved		Yurik	T103299 Graphoid tests fail

Event Timeline

• mobrovac created this task.Jun 19 2015, 1:40 PM

• mobrovac assigned this task to MoritzMuehlenhoff.

• mobrovac raised the priority of this task from to High.

• mobrovac updated the task description. (Show Details)

• mobrovac added projects: acl*sre-team, Services, Graphoid.

• mobrovac added subscribers: • mobrovac, akosiaris, Yurik.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 19 2015, 1:40 PM

• mobrovac added a parent task: T101870: Service containment for nodejs-based services with firejail.Jun 19 2015, 1:41 PM

@Yurik, could you provide a Graphoid URL that should return a valid PNG in deployment-prep so we can test?

Change 219801 had a related patch set uploaded (by Muehlenhoff):
Enable firejail for graphoid

https://gerrit.wikimedia.org/r/219801

gerritbot added a project: Patch-For-Review.Jun 22 2015, 10:11 AM

You can use this link to find graphs available on a wiki.

Try this one:
http://en.wikipedia.beta.wmflabs.org/api/rest_v1/page/graph/png/Wikipedia%3AEdit_filter%2FFalse_positives/220336/503f9a644803897675cf01969ce49644e3eae03a.png

• mobrovac added a subtask: T103299: Graphoid tests fail.Jul 16 2015, 11:45 AM

Restricted Application added a subscriber: Matanya. · View Herald TranscriptJul 16 2015, 11:45 AM

Yurik closed subtask T103299: Graphoid tests fail as Resolved.Jul 16 2015, 11:49 PM

Change 219801 merged by Muehlenhoff:
Enable firejail for graphoid

https://gerrit.wikimedia.org/r/219801

Muehlenhoff mentioned this in rOPUPf6d32e746b97: Enable firejail for graphoid.Jul 22 2015, 8:42 AM

Firejail for Graphoid has been enabled in production on sca100[12].