Mar 17, 2025 · Mar 14, 2025 · Mar 14, 2025 · Mar 14, 2025 · Mar 14, 2025
diff --git a/agent/agentexec/cli_linux.go b/agent/agentexec/cli_linux.go
 "golang.org/x/sys/unix"
 "golang.org/x/xerrors"
 "kernel.org/pub/linux/libs/security/libcap/cap"

 "github.com/coder/coder/v2/agent/usershell"
 )

 // CLI runs the agent-exec command. It should only be called by the cli package.

 // Remove environment variables specific to the agentexec command. This is
 // especially important for environments that are attempting to develop Coder in Coder.
 env := os.Environ()
 ei := usershell.SystemEnvInfo{}
 env := ei.Environ()
 env = slices.DeleteFunc(env, func(e string) bool {
 return strings.HasPrefix(e, EnvProcPrioMgmt) ||
 strings.HasPrefix(e, EnvProcOOMScore) ||
diff --git a/agent/usershell/usershell.go b/agent/usershell/usershell.go
 }

 func (SystemEnvInfo)Environ() []string {
 returnos.Environ()
 varenv []string
 for_,e:=rangeos.Environ() {
 // Ignore GOTRACEBACK=none, as it disables stack traces, it can
 // be set on the agent due to changes in capabilities.
 // https://pkg.go.dev/runtime#hdr-Security.
 ife=="GOTRACEBACK=none" {
 continue
 }
 env=append(env,e)
 }
 returnenv
 }

 func (SystemEnvInfo)HomeDir() (string,error) {
diff --git a/agent/usershell/usershell_test.go b/agent/usershell/usershell_test.go
 require.NotEmpty(t, shell)
 })
 })

 t.Run("Remove GOTRACEBACK=none", func(t *testing.T) {
 t.Setenv("GOTRACEBACK", "none")
 ei := usershell.SystemEnvInfo{}
 env := ei.Environ()
 for _, e := range env {
 require.NotEqual(t, "GOTRACEBACK=none", e)
 }
 })
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -17,6 +17,8 @@ import (
		"golang.org/x/sys/unix"
		"golang.org/x/xerrors"
		"kernel.org/pub/linux/libs/security/libcap/cap"

		"github.com/coder/coder/v2/agent/usershell"
		)

		// CLI runs the agent-exec command. It should only be called by the cli package.
Expand DownExpand Up		@@ -114,7 +116,8 @@ func CLI() error {

		// Remove environment variables specific to the agentexec command. This is
		// especially important for environments that are attempting to develop Coder in Coder.
		env := os.Environ()
		ei := usershell.SystemEnvInfo{}
		env := ei.Environ()
		env = slices.DeleteFunc(env, func(e string) bool {
		return strings.HasPrefix(e, EnvProcPrioMgmt) \|\|
		strings.HasPrefix(e, EnvProcOOMScore) \|\|
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -50,7 +50,17 @@ func (SystemEnvInfo) User() (*user.User, error) {
		}

		func (SystemEnvInfo)Environ() []string {
		returnos.Environ()
		varenv []string
		for_,e:=rangeos.Environ() {
		// Ignore GOTRACEBACK=none, as it disables stack traces, it can
		// be set on the agent due to changes in capabilities.
		// https://pkg.go.dev/runtime#hdr-Security.
		ife=="GOTRACEBACK=none" {
Copy link Collaborator sreyaMar 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Is there any way for us to override this for ourselves that doesn't also override it for any user of coder? Seems like we're choosing for any user of coder that GOTRACEBACK shouldn't be set. Copy link MemberAuthor mafredriMar 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. On Linux, we could theoretically read`/proc/self/environ` to figure out if it was set externally or by the Go runtime. I'm not sure it's worth the lift though. If someone sets this env in, say, a docker container resource. Yes, it will be filtered out for child-processes (which arguably may be the right thing to do anyway). But if someone sets it on the agent resource (which is the recommended way anyway), they absolutely still can. sreya reacted with thumbs up emoji
		continue
		}
		env=append(env,e)
		}
		returnenv
		}

		func (SystemEnvInfo)HomeDir() (string,error) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -43,4 +43,13 @@ func TestGet(t *testing.T) {
		require.NotEmpty(t, shell)
		})
		})

		t.Run("Remove GOTRACEBACK=none", func(t *testing.T) {
		t.Setenv("GOTRACEBACK", "none")
		ei := usershell.SystemEnvInfo{}
		env := ei.Environ()
		for _, e := range env {
		require.NotEqual(t, "GOTRACEBACK=none", e)
		}
		})
		}