Skip to content

Fix filesystem permission parity #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 16, 2023
Merged

Fix filesystem permission parity #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d395c73
Change permissions of /opt layers directory
joe4dev Oct 4, 2023
35e1df2
Fix permissions for tmp directory
joe4dev Oct 4, 2023
11d4975
Handle errors in drop priviledges
joe4dev Oct 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions cmd/localstack/file_utils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
package main

import (
"os"
"path/filepath"
)

// Inspired by https://stackoverflow.com/questions/73864379/golang-change-permission-os-chmod-and-os-chowm-recursively
// but using the more efficient WalkDir API
func ChmodRecursively(root string, mode os.FileMode) error {
return filepath.WalkDir(root,
func(path string, d os.DirEntry, err error) error {
if err != nil {
return err
}
err = os.Chmod(path, mode)
if err != nil {
return err
}
return nil
})
}
19 changes: 16 additions & 3 deletions cmd/localstack/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,15 @@ func main() {
log.Fatal("Failed to download code archives: " + err.Error())
}

// fix permissions of the layers directory for better AWS parity
if err := ChmodRecursively("/opt", 0755); err != nil {
log.Warnln("Could not change file mode recursively of directory /opt:", err)
}
// fix permissions of the tmp directory for better AWS parity
if err := ChmodRecursively("/tmp", 0700); err != nil {
Copy link
Member Author

@joe4dev joe4dev Oct 4, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we do that for the directory only assuming that in ephemeral environments /tmp should be empty 🤔 ?
I guess that's mostly relevant for custom worker scenarios.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think in custom worker scenarios we might want to clear the /tmp directory anyway?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I fully agree 👍 . Assuming an empty /tmp directory seems fair.

Hence, it doesn't matter too much.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI custom worker currently cleans /tmp, /var/task and /opt

log.Warnln("Could not change file mode recursively of directory /tmp:", err)
}

// parse CLI args
bootstrap, handler := getBootstrap(os.Args)

Expand All @@ -141,11 +150,15 @@ func main() {
gid := 990
AddUser(lsOpts.User, uid, gid)
if err := os.Chown("/tmp", uid, gid); err != nil {
log.Warnln("Could not change owner of /tmp:", err)
log.Warnln("Could not change owner of directory /tmp:", err)
}
UserLogger().Debugln("Process running as root user.")
DropPrivileges(lsOpts.User)
UserLogger().Debugln("Process running as non-root user.")
err := DropPrivileges(lsOpts.User)
if err != nil {
log.Warnln("Could not drop root privileges.", err)
} else {
UserLogger().Debugln("Process running as non-root user.")
}
}

logCollector := NewLogCollector()
Expand Down
4 changes: 2 additions & 2 deletions cmd/localstack/user.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,12 @@ func UserLogger() *log.Entry {
}
uid := os.Getuid()
uidString := strconv.Itoa(uid)
user, err := user.LookupId(uidString)
userObject, err := user.LookupId(uidString)
if err != nil {
log.Warnln("Could not look up user by uid:", uid, err)
}
return log.WithFields(log.Fields{
"username": user.Username,
"username": userObject.Username,
"uid": uid,
"euid": os.Geteuid(),
"gid": os.Getgid(),
Expand Down