· about 35 minutes · runs on ubuntu-26.04-devops · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
myapp.service renders its configuration before it starts: render-config fills the placeholders
@DB_HOST@ and @DB_PASSWORD@ in /etc/myapp/app.conf.tmpl from the shell assignments in
/etc/myapp/secrets.env, and writes /etc/myapp/app.conf. Then myapp-login logs in to the
database with that password.
The password was rotated this morning — the new one came from the password manager and contains a
/, an &, a $ and a backslash. Since then myapp does not start. Someone fixed app.conf by
hand; it worked until the next restart. The security team also noticed that app.conf can be read
by every user on the machine.
What is expected, and graded — the grader runs render-config itself, through the
RENDER_TEMPLATE, RENDER_VALUES and RENDER_OUT variables the script already reads:
myapp.service starts and logs in with the rotated password — and still does after a reboot.You have root through sudo. The password itself stays as it is.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_any_password_survives | Substitute any value into a template literally, whatever characters it contains |
| 02_the_config_stays_private | Write a file that holds a secret so that nobody else can ever read it |
| 03_a_missing_value_fails | Refuse to render a configuration with a value missing |
| 04_the_service_logs_in | Substitute any value into a template literally, whatever characters it contains |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 1 sedman 2 umaskman 1 chmodman 1 bashman 5 systemd.service4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
What does this print?
p='a&b'
printf 'x = @P@\n' | sed -e "s/@P@/$p/"
x = a@P@b
In sed's replacement text an unescaped & stands for the whole text that matched, so it is replaced by @P@ and the placeholder reappears in the output. This is the dangerous case: the command succeeds and the result is silently wrong.
man 1 sed (The s Command) · executed in a sandbox
What does this print?
t='x = @P@'
p='k3y/&Pa$$\1-vault'
echo "${t//@P@/"$p"}"
x = k3y/&Pa$$\1-vault
The replacement side of ${var//pattern/replacement} is not a pattern, and quoting the expansion makes even a backslash literal, so the value is inserted exactly as it is — slash, ampersand, dollars and backslash included. The prefix "x = " of the template is kept, because only the placeholder is replaced.
man 1 bash (Parameter Expansion) · executed in a sandbox
A script running with umask 022 creates a configuration file with `echo "$text" > /etc/app.conf` and then runs `chmod 600 /etc/app.conf`. What are the file's permissions in between, and why does it matter?
0644 — the secret is world-readable while it is written
A new file is created with 0666 & ~umask, so 0644 here, and it holds the secret from its first byte until the chmod. Anyone who opens it in that window can read it, and keeps the open descriptor afterwards. umask 077 before creating the file closes the window.
man 2 umask