Plugin security


Go to solution Solved by itimpi,

Recommended Posts

Hi all,

asking for a friend... for real, as I already own an Unraid server. ;) A friend of mine is interested in Unraid, but he questions the security of plugins.

 

For Docker, we both understand how security works in that regard, but we are unsure about plugins.

 

So the concrete questions:

  1. What prevents a potentially malicious plugin from being posted (and thereby installed) in the plugin repository?
  2. If a non-malicious plugin becomes malicious through an update... would that be caught somehow?

 

Maybe an explanation on what a plugin is or is not actually allowed to do would be helpful, as well as a short summary of a potential plugin review process.

 

Thanks a lot! :)

 

Link to comment
  • Solution

Plugins can do just about anything so in that sense they are a security risk.   Users should definitely not install any random plugin.   If a malicious user gains access to your server then they could install a rogue plugin.  However a plugin will not survive a server reboot unless there is a corresponding .plg file in the ‘config/plugins’ folder on the flash drive so at least it will be visible.


it is expected  that plugins make their source code publicly available (not sure if there are any that do not conform to this rule).   I know that they are not added to CA unless their is a chance to review their code.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.