fix: set PATH on bare-based rocks
Metadata
Current evaluation
Merged fix that sets the default Ubuntu PATH on bare-based rocks images to mitigate security risks if the Pebble entrypoint is bypassed. Approved by three reviewers, passed CI, and resolves issue #711.
Suggested action: —
No scores available.
Issue body
If the PATH is empty, Pebble will be default use the standard Ubuntu value
of "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" (see [0]).
Follow this lead and set this value on the image's PATH.
This PATH setting on the image itself has no bearing on most cases, as the
PATH that prevails is the one defined by Pebble and its services, but an
empty (or unset) PATH is a potential security issue in cases where the pebble
entrypoint is bypassed.
0: https://github.com/canonical/pebble/blob/master/internals/overlord/cmdstate/request.go#L91
Fixes #711
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged fix that sets the default Ubuntu PATH on bare-based rocks images to mitigate security risks if the Pebble entrypoint is bypassed. Approved by three reviewers, passed CI, and resolves issue #711. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a fix setting the default Ubuntu PATH on bare-based rocks images. This prevents security risks if the Pebble entrypoint is bypassed and matches Pebble's default behavior. Resolves #711. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a fix to set the default Ubuntu PATH on bare-based rocks images, preventing security vulnerabilities when the Pebble entrypoint is bypassed. Resolves #711. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #552 fix: change pebble dir in 24.04 from /.rock/bin to /usr/bin | rockcraft | merged | Merged a fix updating the pebble binary path from /.rock/bin to /usr/bin for Ubuntu 24.04+ rocks. Approved by two reviewers, passed CI, and builds on PR #528 to ensure stable runtime paths. | |
| #528 fix(pebble): place pebble in a separate location | rockcraft | merged | Merged. Relocates the pebble binary to .rock/bin/ to resolve conflicts with Ubuntu 24.04's bin symlink. Approved by reviewers and passed CI. Reviewers confirmed adding .rocks/bin to $PATH for docker exec compatibility, tracked as ROCKS-1088. | |
| #711 Set PATH on the rock for bare bases | rockcraft | closed | Closed without a repository fix. The request was tracked via internal Jira ticket CRAFT-3437, indicating the security improvement for bare base PATH configuration was moved to internal development rather than resolved here. | |
| #729 Improve detection/setting of the PATH environment variable | rockcraft | open | Rockcraft issue to generalize empty-PATH detection beyond bare-based rocks; set_default_path still only handles bare. Labeled good first issue, last activity 381 days ago. A contributor claimed #725 fixed it, but code confirms it's unfixed. |