# Chef-solo documentation may cause security issues on implementations

**URL:** <https://discourse.chef.io/t/chef-solo-documentation-may-cause-security-issues-on-implementations/17718>\
**Category:** Chef Infra (archive)\
**Created:** [September 21, 2020, 2:32pm UTC](https://discourse.chef.io/t/chef-solo-documentation-may-cause-security-issues-on-implementations/17718 "2020-09-21T14:32:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![goku704](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/goku704/32/2651_2.png) [@goku704](https://discourse.chef.io/u/goku704)\
**Post date:** [September 21, 2020, 2:32pm UTC](https://discourse.chef.io/t/chef-solo-documentation-may-cause-security-issues-on-implementations/17718/1 "2020-09-21T14:32:37Z")

</div>

Hi,

I'd like to inform you about one potential risk where system administrators might be misled to where the "chef" user is not supposed to have root privileges on the host system.

> **[chef-solo (executable)](https://docs.chef.io/ctl_chef_solo/#run-as-non-root-user)**

Since, non-root users can run Ruby scripts with passwordless sudo privileges defined in the sudoers file then the "chef" user can create a Ruby file containing "system('/bin/bash')" in order to get a root shell.

```
chef@localhost$ sudo chef-solo -c /tmp/shell.rb
root@localhost#

```

Therefore, I think the documentation might need some warning or definition where system administrators need to use chef-solo accessible for unprivileged users who should not become the built-in root user.

Kind regards.

---

<div class="post-metadata">

**Author:** ![bennyvasquez](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bennyvasquez/32/2559_2.png) [@bennyvasquez](https://discourse.chef.io/u/bennyvasquez)\
**Post date:** [September 23, 2020, 3:18pm UTC](https://discourse.chef.io/t/chef-solo-documentation-may-cause-security-issues-on-implementations/17718/2 "2020-09-23T15:18:47Z")

</div>

Hi there, and welcome! Thanks for this report. The best way to report security concerns like this is to open an issue on the appropriate github repo (in this case the [chef-web-docs](https://github.com/chef/chef-web-docs) repo). In this case, I've [duplicated your report](https://github.com/chef/chef-web-docs/issues/2665) on the repo for you.

Additionally, since we're an open source community, we welcome pull requests! If you have an interest in contributing, feel free to open a pull request against that same repo.

---

<div class="post-metadata">

**Author:** ![goku704](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/goku704/32/2651_2.png) [@goku704](https://discourse.chef.io/u/goku704)\
**Post date:** [September 23, 2020, 3:42pm UTC](https://discourse.chef.io/t/chef-solo-documentation-may-cause-security-issues-on-implementations/17718/3 "2020-09-23T15:42:28Z")

</div>

Hey Benny

I must have missed the documents github repo, so thank you for opening the issue 🙂 . I'll update the markdown document and send a PR then.