diff options
| author | Dan Duvall <dduvall@wikimedia.org> | 2017-06-15 17:34:47 -0700 |
|---|---|---|
| committer | Dan Duvall <dduvall@wikimedia.org> | 2017-06-20 10:17:53 -0700 |
| commit | 77b95b1f94de7cc6c1e28c0fdf2b4ecab93dd91a (patch) | |
| tree | c136226a28999b65f85fd8c4257591478ca99d7f /config | |
| parent | bbb5eba26ae3edb671693c10d6d73a958546af27 (diff) | |
| download | blubber-77b95b1f94de7cc6c1e28c0fdf2b4ecab93dd91a.tar.gz | |
Set HOME environment variable for runs-as user
Summary:
Fixes build issues around home permissions by setting `HOME` to the
unprivileged user's home directory once the "privileges dropped" build
phase has been reached.
Test Plan: Run `go test ./...`.
Reviewers: thcipriani, mobrovac, hashar, Jrbranaa, mmodell, #release-engineering-team
Reviewed By: mobrovac
Tags: #release-engineering-team
Differential Revision: https://phabricator.wikimedia.org/D686
Diffstat (limited to 'config')
| -rw-r--r-- | config/runs.go | 28 |
1 files changed, 16 insertions, 12 deletions
diff --git a/config/runs.go b/config/runs.go index f2756a5..7567685 100644 --- a/config/runs.go +++ b/config/runs.go @@ -25,25 +25,29 @@ func (run RunsConfig) InstructionsForPhase(phase build.Phase) []build.Instructio switch phase { case build.PhasePrivileged: if run.In != "" { - ins = append(ins, []build.Instruction{{build.Run, []string{"mkdir -p ", run.In}}}...) + ins = append(ins, build.Instruction{build.Run, []string{"mkdir -p ", run.In}}) } if run.As != "" { - ins = append(ins, []build.Instruction{ - {build.Run, []string{ - "groupadd -o -g ", strconv.Itoa(run.Gid), " -r ", run.As, " && ", - "useradd -o -m -r -g ", run.As, " -u ", strconv.Itoa(run.Uid), " ", run.As, - }}, - }...) + ins = append(ins, build.Instruction{build.Run, []string{ + "groupadd -o -g ", strconv.Itoa(run.Gid), " -r ", run.As, " && ", + "useradd -o -m -d /home/", run.As, " -r -g ", run.As, + " -u ", strconv.Itoa(run.Uid), " ", run.As, + }}) if run.In != "" { - ins = append(ins, []build.Instruction{ - {build.Run, []string{ - "chown ", run.As, ":", run.As, " ", run.In, - }}, - }...) + ins = append(ins, build.Instruction{build.Run, []string{ + "chown ", run.As, ":", run.As, " ", run.In, + + }}) } } + case build.PhasePrivilegeDropped: + if run.As != "" { + ins = append(ins, build.Instruction{build.Env, []string{ + "HOME=\"/home/" + run.As + "\"", + }}) + } } return ins |