Security issue?

[BianchiDude]

Is this a security issue?

I noticed when restoring an account the files are owned by root until the end of the restore process, and are also owned by the group root, when all the files are chowned back to the regular username.

For a large account it can often take 30min - 1 hour or more to restore.

Does this pose a security risk?

[rpmws]

Is this a security issue?

I noticed when restoring an account the files are owned by root until the end of the restore process, and are also owned by the group root, when all the files are chowned back to the regular username.

For a large account it can often take 30min - 1 hour or more to restore.

Does this pose a security risk?

i would think that would be a security advantage NOT a risk?

[cpanelkenneth]

As long as none are setuid, there should be little to no problem with this. Being owned by root, the user will have little control over the files, especially when accessed via the cPanel interface as we perform a number of checks when performing actions as the user.

Since the restore process is not executing anything in the backup, any attack vector would be vanishingly small to non-existent.