Maksim ShulgaandMaxim Shulga 6f8af2cfa4 Reject UID or GID zero unless a documented use case requires it (#32) ...

* Reject UID or GID zero unless a documented use case requires it

setup_uid() would happily remap the seafile user to UID/GID 0, which
after the previous non-root fix would mean drop_privileges() drops
straight back into root. main() now rejects --uid/SEAFILE_UID and
--gid/SEAFILE_GID being 0 with exit code 2, before setup_uid() runs.

Verified against the real image via tests/smoke.sh.

* Clarify the GID=0 rejection message

Copilot review: 'group root' isn't a commonly used phrase. Name GID 0
as the root group explicitly instead.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

2026-08-03 17:59:38 +00:00

..

conftest.py

Authenticate from mounted secrets and stop passing the password to seaf-cli

2026-08-02 17:21:46 -07:00

smoke.sh

Reject UID or GID zero unless a documented use case requires it (#32)

2026-08-03 17:59:38 +00:00

test_commands.py

Run the long-lived process as the configured non-root user (#31)

2026-08-03 17:44:34 +00:00

test_config.py

Read the environment with typed parsers and apply the documented defaults

2026-08-02 17:44:57 -07:00

test_daemon.py

Authenticate from mounted secrets and stop passing the password to seaf-cli

2026-08-02 17:21:46 -07:00

test_http.py

Bound HTTP request timeouts and retry budget (#28)

2026-08-03 04:58:14 +00:00

test_paths.py

Stop server-provided values from reaching a shell or escaping /dsc/seafile

2026-08-02 16:53:19 -07:00

test_secrets.py

Authenticate from mounted secrets and stop passing the password to seaf-cli

2026-08-02 17:21:46 -07:00