Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit466bc6b

Browse files
committed
ensure agent binary permissions owner/w+x
1 parentcf17cd4 commit466bc6b

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

‎agent/agentcontainers/api.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1025,9 +1025,13 @@ func (api *API) injectSubAgentIntoContainerLocked(ctx context.Context, dc coders
10251025
logger.Info(ctx,"copied agent binary to container")
10261026

10271027
// Make sure the agent binary is executable so we can run it.
1028-
if_,err:=api.ccli.ExecAs(ctx,container.ID,"root","chmod","+x",coderPathInsideContainer);err!=nil {
1028+
if_,err:=api.ccli.ExecAs(ctx,container.ID,"root","chmod","0755",path.Dir(coderPathInsideContainer),coderPathInsideContainer);err!=nil {
10291029
returnxerrors.Errorf("set agent binary executable: %w",err)
10301030
}
1031+
// Set the owner of the agent binary to root:root (UID 0, GID 0).
1032+
if_,err:=api.ccli.ExecAs(ctx,container.ID,"root","chown","0:0",path.Dir(coderPathInsideContainer),coderPathInsideContainer);err!=nil {
1033+
returnxerrors.Errorf("set agent binary owner: %w",err)
1034+
}
10311035

10321036
// Attempt to add CAP_NET_ADMIN to the binary to improve network
10331037
// performance (optional, allow to fail).

‎agent/agentcontainers/api_test.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1278,7 +1278,8 @@ func TestAPI(t *testing.T) {
12781278
mCCLI.EXPECT().DetectArchitecture(gomock.Any(),"test-container-id").Return(runtime.GOARCH,nil),
12791279
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","mkdir","-p","/.coder-agent").Return(nil,nil),
12801280
mCCLI.EXPECT().Copy(gomock.Any(),"test-container-id",coderBin,"/.coder-agent/coder").Return(nil),
1281-
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","chmod","+x","/.coder-agent/coder").Return(nil,nil),
1281+
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","chmod","0755","/.coder-agent","/.coder-agent/coder").Return(nil,nil),
1282+
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","chown","0:0","/.coder-agent","/.coder-agent/coder").Return(nil,nil),
12821283
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","setcap","cap_net_admin+ep","/.coder-agent/coder").Return(nil,nil),
12831284
)
12841285

@@ -1324,7 +1325,8 @@ func TestAPI(t *testing.T) {
13241325
mCCLI.EXPECT().DetectArchitecture(gomock.Any(),"test-container-id").Return(runtime.GOARCH,nil),
13251326
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","mkdir","-p","/.coder-agent").Return(nil,nil),
13261327
mCCLI.EXPECT().Copy(gomock.Any(),"test-container-id",coderBin,"/.coder-agent/coder").Return(nil),
1327-
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","chmod","+x","/.coder-agent/coder").Return(nil,nil),
1328+
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","chmod","0755","/.coder-agent","/.coder-agent/coder").Return(nil,nil),
1329+
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","chown","0:0","/.coder-agent","/.coder-agent/coder").Return(nil,nil),
13281330
mCCLI.EXPECT().ExecAs(gomock.Any(),"test-container-id","root","setcap","cap_net_admin+ep","/.coder-agent/coder").Return(nil,nil),
13291331
)
13301332

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp