starred/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-02-05 00:29:55 +03:00
Code Issues 14 Packages Projects Releases 10 Wiki Activity

Creating a cron job that routinely pulls a script from the Internet and runs it as root is... not a great idea #1072

New Issue
Closed
opened 2026-02-04 22:53:33 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-04 22:53:33 +03:00
Owner
Copy Link

Originally created by @TFenby on GitHub (Jun 5, 2025).

✅ Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

cron-update-lxcs.sh

📂 What was the exact command used to execute the script?

n/a

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

No response

📝 Provide a clear and concise description of the issue.

As the title says, the current cron-update-lxcs.sh is a security nightmare waiting to happen. At most, the version of update-lxcs-cron.sh currently published should be downloaded and cached locally.

🔄 Steps to reproduce the issue.

n/a

❌ Paste the full error output (if available).

n/a

🖼️ Additional context (optional).

n/a

Originally created by @TFenby on GitHub (Jun 5, 2025). ### ✅ Have you read and understood the above guidelines? yes ### 📜 What is the name of the script you are using? cron-update-lxcs.sh ### 📂 What was the exact command used to execute the script? n/a ### ⚙️ What settings are you using? - [ ] Default Settings - [ ] Advanced Settings ### 🖥️ Which Linux distribution are you using? _No response_ ### 📝 Provide a clear and concise description of the issue. As the title says, the current `cron-update-lxcs.sh` is a security nightmare waiting to happen. At most, the version of `update-lxcs-cron.sh` currently published should be downloaded and cached locally. ### 🔄 Steps to reproduce the issue. n/a ### ❌ Paste the full error output (if available). n/a ### 🖼️ Additional context (optional). n/a
OVERLORD added the bug label 2026-02-04 22:53:33 +03:00
OVERLORD commented 2026-02-04 22:53:42 +03:00
Author
Owner
Copy Link

@MickLesk commented on GitHub (Jun 5, 2025):

Then make a sensible suggestion 🤷🏼‍♂️

The only solution would be that
you would have to install a shell script on each LXC, which always has exactly the same name, so that the Proxmox host can address it. Everything must be callable via PCT. This is not worth the huge effort, and whether it works properly at all is another question. If you don't like the script - as with all other scripts in the repo - you don't have to use it.

By the way, LXCs are always root.

@MickLesk commented on GitHub (Jun 5, 2025): Then make a sensible suggestion 🤷🏼‍♂️ The only solution would be that you would have to install a shell script on each LXC, which always has exactly the same name, so that the Proxmox host can address it. Everything must be callable via PCT. This is not worth the huge effort, and whether it works properly at all is another question. If you don't like the script - as with all other scripts in the repo - you don't have to use it. By the way, LXCs are always root.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Implemented in VED waiting push to Main
breaking change
bug
bug
bugfix
deferred
delete script
dependencies
enhancement
external
feature
github
help wanted
in project pipeline
invalid
investigation
json
maintenance
needs triage
new script
new script
nice to have
not a script issue
not planned
organization
pull-request
Mirrored from GitHub Pull Request
 question
refactor
rename script
security
update script
website
wontdo
🛑 Failure to comply with the guidelines
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/ProxmoxVE#1072
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?