FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Fix filesystem permission parity by joe4dev · Pull Request #22 · localstack/lambda-runtime-init · GitHub

/ lambda-runtime-init Public
forked from aws/aws-lambda-runtime-interface-emulator

Fix filesystem permission parity #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joe4dev merged 3 commits into from
Oct 16, 2023
Conversation 4 Commits 3 Checks 0 Files changed
Merged

Fix filesystem permission parity #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d395c73
Change permissions of /opt layers directory
joe4dev Oct 4, 2023
35e1df2
Fix permissions for tmp directory
joe4dev Oct 4, 2023
11d4975
Handle errors in drop priviledges
joe4dev Oct 4, 2023
File filter

Filter by extension

Filter by extension .go  (3) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
22 changes: 22 additions & 0 deletions cmd/localstack/file_utils.go
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
package main

import (
"os"
"path/filepath"
)

// Inspired by https://stackoverflow.com/questions/73864379/golang-change-permission-os-chmod-and-os-chowm-recursively
// but using the more efficient WalkDir API
func ChmodRecursively(root string, mode os.FileMode) error {
return filepath.WalkDir(root,
func(path string, d os.DirEntry, err error) error {
if err != nil {
return err
}
err = os.Chmod(path, mode)
if err != nil {
return err
}
return nil
})
}
19 changes: 16 additions & 3 deletions cmd/localstack/main.go
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,15 @@ func main() {
log.Fatal("Failed to download code archives: " + err.Error())
}

// fix permissions of the layers directory for better AWS parity
if err := ChmodRecursively("/opt", 0755); err != nil {
log.Warnln("Could not change file mode recursively of directory /opt:", err)
}
// fix permissions of the tmp directory for better AWS parity
if err := ChmodRecursively("/tmp", 0700); err != nil {

joe4dev Oct 4, 2023 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Should we do that for the directory only assuming that in ephemeral environments /tmp should be empty 🤔 ?
I guess that's mostly relevant for custom worker scenarios.

dfangl Oct 10, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I think in custom worker scenarios we might want to clear the /tmp directory anyway?

joe4dev Oct 10, 2023

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I fully agree 👍 . Assuming an empty /tmp directory seems fair.

Hence, it doesn't matter too much.

dominikschubert Oct 13, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

FYI custom worker currently cleans /tmp, /var/task and /opt
log.Warnln("Could not change file mode recursively of directory /tmp:", err)
}

// parse CLI args
bootstrap, handler := getBootstrap(os.Args)

Expand All @@ -141,11 +150,15 @@ func main() {
gid := 990
AddUser(lsOpts.User, uid, gid)
if err := os.Chown("/tmp", uid, gid); err != nil {
log.Warnln("Could not change owner of /tmp:", err)
log.Warnln("Could not change owner of directory /tmp:", err)
}
UserLogger().Debugln("Process running as root user.")
DropPrivileges(lsOpts.User)
UserLogger().Debugln("Process running as non-root user.")
err := DropPrivileges(lsOpts.User)
if err != nil {
log.Warnln("Could not drop root privileges.", err)
} else {
UserLogger().Debugln("Process running as non-root user.")
}
}

logCollector := NewLogCollector()
Expand Down
4 changes: 2 additions & 2 deletions cmd/localstack/user.go
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,12 @@ func UserLogger() *log.Entry {
}
uid := os.Getuid()
uidString := strconv.Itoa(uid)
user, err := user.LookupId(uidString)
userObject, err := user.LookupId(uidString)
if err != nil {
log.Warnln("Could not look up user by uid:", uid, err)
}
return log.WithFields(log.Fields{
"username": user.Username,
"username": userObject.Username,
"uid": uid,
"euid": os.Geteuid(),
"gid": os.Getgid(),
Expand Down
Back | FazBrowse Home | New Git URL