8000 ensure agent binary permissions owner/w+x · coder/coder@466bc6b · GitHub
[go: up one dir, main page]
Skip to content

Commit 466bc6b

Browse files
mafredrimafredri
committed
ensure agent binary permissions owner/w+x
1 parent cf17cd4 commit 466bc6b

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

‎agent/agentcontainers/api.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1025,9 +1025,13 @@ func (api *API) injectSubAgentIntoContainerLocked(ctx context.Context, dc coders
10251025
logger.Info(ctx, "copied agent binary to container")
10261026

10271027
// Make sure the agent binary is executable so we can run it.
1028-
if _, err := api.ccli.ExecAs(ctx, container.ID, "root", "chmod", "+x", coderPathInsideContainer); err != nil {
1028+
if _, err := api.ccli.ExecAs(ctx, container.ID, "root", "chmod", "0755", path.Dir(coderPathInsideContainer), coderPathInsideContainer); err != nil {
10291029
return xerrors.Errorf("set agent binary executable: %w", err)
10301030
}
1031+
// Set the owner of the agent binary to root:root (UID 0, GID 0).
1032+
if _, err := api.ccli.ExecAs(ctx, container.ID, "root", "chown", "0:0", path.Dir(coderPathInsideContainer), coderPathInsideContainer); err != nil {
1033+
return xerrors.Errorf("set agent binary owner: %w", err)
1034+
}
10311035

10321036
// Attempt to add CAP_NET_ADMIN to the binary to improve network
10331037
// performance (optional, allow to fail).

‎agent/agentcontainers/api_test.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1278,7 +1278,8 @@ func TestAPI(t *testing.T) {
12781278
mCCLI.EXPECT().DetectArchitecture(gomock.Any(), "test-container-id").Return(runtime.GOARCH, nil),
12791279
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "mkdir", "-p", "/.coder-agent").Return(nil, nil),
12801280
mCCLI.EXPECT().Copy(gomock.Any(), "test-container-id", coderBin, "/.coder-agent/coder").Return(nil),
1281-
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chmod", "+x", "/.coder-agent/coder").Return(nil, nil),
1281+
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chmod", "0755", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
1282+
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chown", "0:0", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
12821283
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "setcap", "cap_net_admin+ep", "/.coder-agent/coder").Return(nil, nil),
12831284
)
12841285

@@ -1324,7 +1325,8 @@ func TestAPI(t *testing.T) {
13241325
mCCLI.EXPECT().DetectArchitecture(gomock.Any(), "test-container-id").Return(runtime.GOARCH, nil),
13251326
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "mkdir", "-p", "/.coder-agent").Return(nil, nil),
13261327
mCCLI.EXPECT().Copy(gomock.Any(), "test-container-id", coderBin, "/.coder-agent/coder").Return(nil),
1327-
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chmod", "+x", "/.coder-agent/coder").Return(nil, nil),
1328+
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chmod", "0755", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
1329+
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "chown", "0:0", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil),
13281330
mCCLI.EXPECT().ExecAs(gomock.Any(), "test-container-id", "root", "setcap", "cap_net_admin+ep", "/.coder-agent/coder").Return(nil, nil),
13291331
)
13301332

0 commit comments

Comments
 (0)
0