github/recorder
1
0
Fork 0
mirror of https://github.com/owntracks/recorder.git synced 2026-08-19 11:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

address suid

Browse Source
This commit is contained in:
Jan-Piet Mens
2026-07-29 14:51:31 +02:00
parent f153d685d1
commit a5a0628515
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/SECURITY.md
+2 -1
View File
@@ -6,9 +6,10 @@ The program was initially an MQTT client only so protected by an MQTT broker. Th
In MQTT mode, the Recorder has no open incoming TCP ports -- it connects out to an MQTT broker (either TCP/1883 or TCP/8883, configurable) and optionally to a geo-location service (TCP/443, likewise configurable).
## file system
Data is stored by the Recorder in either plain files or in an LMDB database, the latter for geo-lookups and sundry other data (see [STORE](store.md)]. Some of this data includes possible payload encryption keys (see below) so the database ought to be well protected.
Data is stored by the Recorder in either plain files or in an LMDB database, the latter for geo-lookups and sundry other data (see [STORE](store.md)]. Some of this data includes possible payload encryption keys (see below) so the database ought to be well protected. Both the Recorder (`ot-recorder`), and its `ocat` utility are installed SUID by default; it is assumed that these utilities will be used on single-user systems fronted by proxies. If this is undesirable, it is possible to install these programs with different permissions.
Any user which has access to the files into which the OwnTracks Recorder stores data can obviously read that data.