Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Permissions of prompt:kube-ps1.sh causes issues with Linux operation as non-root user #767

Closed
drmikecrowe opened this issue Jan 30, 2022 · 1 comment · Fixed by #769 or #771
Closed

Comments

@drmikecrowe
Copy link

drmikecrowe commented Jan 30, 2022

Describe the Bug

The permissions for /etc/profile.d/prompt:kube-ps1.sh as very restrictive. This impacts #594.

Steps to Reproduce

Steps to reproduce the behavior:

  1. Execute docker run -it --rm cloudposse/geodesic:latest-debian --login
  2. Execute:
 ⧉  geodesic 
 ✗ . [none] ~ ⨠ ls -l --color /etc/profile.d/prom*
-rwxrwxrwx 1 root root  7534 Jan 24 22:45 /etc/profile.d/prompt.sh
-rw------- 1 root root 10441 Jan  1  1970 /etc/profile.d/prompt:kube-ps1.sh

Expected Behavior

All scripts should have similar permissions and not be restricted to just root

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

  • OS: Linux Mint
  • Version 20.2 (uma) -- based on Ubuntu (focal)
  • Geodesic version 0.149.1 based on Debian GNU/Linux 10 (buster) (10.11)
@drmikecrowe drmikecrowe added the bug 🐛 An issue with the system label Jan 30, 2022
@Nuru
Copy link
Contributor

Nuru commented Jan 31, 2022

This is one of a number of issues that we sidestep by running as root. (Note that the file in question, /etc/profile.d/prompt:kube-ps1.sh, is not a file in our repo, it is installed at build time from the jonmosco/kube-ps1 project.)

Geodesic is big, complex, and designed to be run with the internal user as root. This is one of only several dozen known issues with trying to run Geodesic as a non-root user, and we have not seen enough benefits from running as non-root to justify the effort of adapting Geodesic to run that way. (See #710 for more details.) It seems a more efficient path is to instead simply mitigate any issues caused by running as root, and we continue to work in that direction. Now that Docker supports rootless mode, the security implications of running as root from within the container should be minimal.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants