Security risk using /var/tmp as HOME

[sdinten]

Description

The fix for #689 is using the path /var/tmp as home folder.
This folder is writable by everybody.

This could have security impact:
Regarding https://docs.docker.com/engine/reference/commandline/cli/ :
By default, the Docker command line stores its configuration files in a directory called .docker within your $HOME directory. Docker manages most of the files in the configuration directory and you should not modify them. However, you can modify the config.json file to control certain aspects of how the docker command behaves.

So every user could invoke changing of docker settings by creating config in /var/tmp/.docker/

@sebastianTC thanks for mentioning this!

Expected Behavior

Everything works as expected but there is a security risk

Steps to Reproduce

Run puppet agent with an environment that uses the docker module

Environment

All

[sdinten]

Already fixed... https://github.com/puppetlabs/puppetlabs-docker/pull/698/files

[sdinten]

No, looking at the tag for 3.13.0 I can see that '/root' was already put in before the release was made. v3.13.0...main

…

On Wed, Dec 16, 2020 at 9:56 AM Marti Raudsepp ***@***.***> wrote: Was the insecure behavior ever part of any Docker release? — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#699 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AL57WWUXXHRUOAF2F6EXKD3SVBY5RANCNFSM4U5R2YWQ> .

[sebastianTC]

@sdinten :

Sorry this isn't right.
The changes you see on your link, are the changes which were merged to the main branch after the release.

So yes the issue is still part of the current release.

v3.12.1...v3.13.0
This are the changes which are part of the last release.

[sdinten]

@sebastianTC you're right (again). It seems that PR #698 (already merged) did not make it into the release. @adrianiurca can you put this pull request in the following update?

[sdinten]

Fixed as of 3.13.1 (PR #698)