Files created by images are root-owned

[mikea]

python script should specify current user id: docker run --user=<uid>:<gid>

[mikea]

While it seem easy to do docker run with a given uid, it creates problems for projects with in-tree builds:

• we build the image as root. I.e. /src/checkout will be owned by root.
• the build script expects the checkout tree to be writable by current uid.

Docker supports build-time variables (you can pass a uid this way), but the image will have uid baked in. This won't work for multiple people.

It seems the only way to fix this is not to use docker run --user in the helper.py, but to pass uid as an environment variable, and to do a chown + su before transferring control to build.sh.

Unless anybody thinks this is too hacky I'll try to make the outlined approach work.

[bilboed]

Hi,

I just tried the uid branch (clean checkout) and it still has the same issue i reported in #203.

A simple way to reproduce is to run build_fuzzers of a simple project (say zlib) : python infra/helper.py build_fuzzers zlib

I've pasted the full log of that command and the resulting build directory permissions here : http://pastebin.com/cAwUGWmt

Notice how it fails to compile libfuzzer because /work is unreadable/unwritable

[mikea]

@bilboed unfortunately it is not that easy to test base image change: you need to rebuild all the images (slow). And the --pull in helper.py is going to screw you and fetch an image from internet anyway (need nice ideas here). @inferno-chromium also had a similar problem recently.

I have double-checked that zip project works for me with this change after rebuilding images.

[mikea]

Let's give our Jenkins couple hours to build new images before trying this.

[bilboed]

Still fails locally.

With a clean checkout of oss-fuzz, "python infra/helper.py build_fuzzers zlib" ends up with :
Compiling libFuzzer to /usr/lib/libFuzzingEngine.a ...mkdir: cannot create directory '/work/libfuzzer': Permission denied

[bilboed]

My bad, the issue was with selinux. and the solution is written in the docker-run manpage. Putting it here for future reference:

chcon -Rt svirt_sandbox_file_t build/