Discussion: Hardening default credentials and filesystem permissions in virtualization components

[RinZ27]

Overview

While reviewing the virtualization and sandbox components (Lume/Lumier), two architectural patterns were identified that could impact the security posture of production-like deployments:

1. Hardcoded Default Credentials: The lume:lume credential pair is consistently used across .yml presets and .sh configuration files (e.g., libs/lume/src/Resources/unattended-presets/sequoia.yml and libs/lumier/src/config/constants.sh). While practical for unattended setups, it poses a risk if these VMs or management interfaces are exposed without modification.
2. Permissive Directory Permissions: Several setup scripts utilize 0777 permissions for sandbox directories. In multi-user or shared host environments, this may facilitate local privilege escalation or unauthorized data access within the sandbox lifecycle.

Proposed Improvements

• Dynamic Credential Generation: Consider introducing a mechanism to generate unique, random passwords during the first-time setup or bootstrap phase, storing them in a local secure vault or environment variables.
• Restrict Permissions: Align with the Principle of Least Privilege by tightening default permissions to 0755 for directories and 0644/0600 for files where world-writability is not technically required for agent/sandbox operations.

I'd be interested to hear the maintainers' thoughts on whether these hardening steps align with the current roadmap for automated deployments.