mongodb runs as root user

[James Page]

I noticed that the mongodb instance that juju creates runs as root; this is not great from a priviledge escalation point of view - if the database is compromised by some sort of zero-day exploit in the future, then access to the database might mean root access to the server its running on.

[John A Meinel (jameinel)]

Note that once we avoid direct access to the state db from agents and clients, we will have the mongo port blocked off by the cloud firewall. Which does limit the effectiveness of this.

We also run jujud itself as root, but generally we have to because we do things like creating LXC containers and installing packages on the machine.

[William Reade (fwereade)]

Nate, I think this is *very* closely related to what you're working on right now -- would you roll this into your pipeline please?

[Mark Ramm (mark-ramm)]

Reducing the security implications of running MongoDB is an important thing for us to do. It's not quite critical, because nobody is asking for it directly now, and the risk is still somewhat limited. But there is a risk, and I think the general policy of treating even security -- even relatively lower risk stuff -- as important is a good habit of mind for us.

We are going to be at the center of a lot of important developments. On the other hand once you can control the MongoDB server, your opportunities for privilege escalation on hosts in that environment are probably greater in other directions.

[Nate Finch (natefinch)]

So, yes, this is something that should be fixed, however, if you have access to the database, you can just add data to it to tell Juju to spin up a unit on the bootstrap node that runs as root and you can then do whatever you want with it. So, while it would be better for appearances' sake to not have mongodb running as root, it doesn't actually close any security holes to a determined attacker. In addition, it's a non-trivial change, since it means we have to create a new user to run mongo as, and in theory upgrade old environments to fix them as well. My suggestion is that we leave it as high and deal with it later.

[Tim Penhey (thumper)]

Critical is a "stop the line" type bug. No one is being assigned to it right now, so it isn't Critical.

[Anastasia (anastasia-macmood)]

Last comments and concerns on this discussion were raised more than 2 years ago.