Skip to content

Conversation

@leongdl
Copy link
Contributor

@leongdl leongdl commented May 26, 2025

What was the problem/requirement? (What/Why)

  • From testing, CMF customers are able to create and customize the Worker Agent persistence directory. This can potentially open security loop holes such as allowing any user on the system to view logs, or cached credentials.
  • Users may accidentally create the cache folders with general read / write access.
  • Note that Deadline Cloud provisions these persistence directories by default with the correct least privilege access. Releases are secure by default. Tests exist and are part of the win_installer tests in integration.

What was the solution? (How)

  • Instead of overwriting the folder with "exists ok", we will now print a warning.
  • There is part of the shared responsibility of running Deadline Worker Agent to ensure the execution environment is secure.
    • For example, a customer debugging a CMF instance may change the cache folder for debugging but forgets to change it back.

What is the impact of this change?

  • Better messaging for folder access permissions.

How was this change tested?

  • Run the install deadline worker agent script on top of an existing installation. See that the new message is printed to the installation log. For example:
Screenshot 2025-05-26 at 3 19 21 PM

Was this change documented?

  • Not Applicable.

Is this a breaking change?

  • Not Applicable.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…during installation. Warns users to be careful of directory permissions.

Signed-off-by: David Leong <[email protected]>
@sonarqubecloud
Copy link

@leongdl leongdl changed the title fix: Add warning messages when persistence directories exist. fix: Add warning messages when persistence directories exist May 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant