fix: Allow root to read Docker Secret files with restrictive permissions
- Remove is_readable() check when running as root - Root can read files even with 0700 permissions - Should fix issue where REDIS_PASSWORD file exists but is not readable (0700, owner 1000, process 0) - Docker secrets may have restrictive permissions that root can bypass
This commit is contained in:
@@ -55,11 +55,25 @@ final readonly class DockerSecretsResolver
|
|||||||
|
|
||||||
$file = FilePath::create($filePath);
|
$file = FilePath::create($filePath);
|
||||||
|
|
||||||
if (!$file->exists() || !$file->isReadable()) {
|
if (!$file->exists()) {
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
$content = file_get_contents($file->toString());
|
// Try to read the file content
|
||||||
|
// Even if is_readable() returns false, we may still be able to read it
|
||||||
|
// (e.g., if running as root, or if permissions allow via group/other)
|
||||||
|
$filePathString = $file->toString();
|
||||||
|
|
||||||
|
// Only skip if definitely not readable AND not running as root
|
||||||
|
$isRoot = function_exists('posix_geteuid') && posix_geteuid() === 0;
|
||||||
|
if (!$file->isReadable() && !$isRoot) {
|
||||||
|
// Not readable and not root, can't read it
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Try to read the file content (suppress warnings, we'll check for false)
|
||||||
|
// Root can read files even with restrictive permissions
|
||||||
|
$content = @file_get_contents($filePathString);
|
||||||
|
|
||||||
if ($content === false) {
|
if ($content === false) {
|
||||||
return null;
|
return null;
|
||||||
|
|||||||
Reference in New Issue
Block a user