Skip to content

Commit a419690

Browse files
l0rdl0rd
authored
Avoid using sudo in agent launchers when the current user is not a sudoer (eclipse-che#5835)
Signed-off-by: Mario Loriedo <mloriedo@redhat.com>
1 parent 53c3842 commit a419690

14 files changed

Lines changed: 305 additions & 24 deletions

File tree

‎agents/che-core-api-agent/src/test/resources/agents-launchers-tests-arbitraryuser.bats‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/usr/bin/env bats
2+
# Copyright (c) 2012-2017 Red Hat, Inc
3+
# All rights reserved. This program and the accompanying materials
4+
# are made available under the terms of the Eclipse Public License v1.0
5+
# which accompanies this distribution, and is available at
6+
# http://www.eclipse.org/legal/epl-v10.html
7+
#
8+
# Contributors:
9+
# Mario
10+
#
11+
# How to run this script:
12+
# cd <root of che local git repository>
13+
# export CHE_BASE_DIR=$(pwd)
14+
# export LAUNCHER_SCRIPT_TO_TEST=wsagent/agent/src/main/resources/org.eclipse.che.ws-agent.script.sh
15+
# export BATS_TEST_SCRIPT=agents/che-core-api-agent/src/test/resources/agents-launchers-tests-arbitraryuser.bats
16+
# export DOCKER_IMAGE=rhche/centos_jdk8
17+
# docker run -ti --rm -e CHE_BASE_DIR -e LAUNCHER_SCRIPT_TO_TEST -e DOCKER_IMAGE \
18+
# -v ${CHE_BASE_DIR}/${BATS_TEST_SCRIPT}:/scripts/launcher_tests.bats \
19+
# -v ${CHE_BASE_DIR}/dockerfiles:/dockerfiles \
20+
# -v /var/run/docker.sock:/var/run/docker.sock \
21+
# eclipse/che-bats bats /scripts/launcher_tests.bats
22+
#
23+
24+
load '/bats-support/load.bash'
25+
load '/bats-assert/load.bash'
26+
. /dockerfiles/cli/tests/test_base.sh
27+
28+
CONTAINER_NAME="test"
29+
30+
script_host_path=${CHE_BASE_DIR}/${LAUNCHER_SCRIPT_TO_TEST}
31+
32+
root_msg="I am root"
33+
not_root_msg="I am a not root"
34+
sudoer_msg="I am a sudoer"
35+
not_sudoer_msg="I am a not a sudoer"
36+
test_snippet="source <(grep -iE -A3 'is_current_user_root\(\)|is_current_user_sudoer\(\)|set_sudo_command\(\)' /launch.sh | grep -v -- "^--$"); is_current_user_root && echo -n '${root_msg} ' || echo -n '${not_root_msg} '; is_current_user_sudoer && echo '${sudoer_msg}' || echo -n '${not_sudoer_msg} '; set_sudo_command; echo SUDO=\${SUDO}"
37+
user="100000"
38+
39+
# Kill running che server instance if there is any to be able to run tests
40+
setup() {
41+
kill_running_named_container ${CONTAINER_NAME}
42+
remove_named_container ${CONTAINER_NAME}
43+
docker run --security-opt no-new-privileges --user=${user} --name="${CONTAINER_NAME}" -d -v ${script_host_path}:/launch.sh "${DOCKER_IMAGE}"
44+
}
45+
46+
teardown() {
47+
kill_running_named_container "${CONTAINER_NAME}"
48+
remove_named_container ${CONTAINER_NAME}
49+
}
50+
51+
@test "should deduce that's not a sudoer nor root when ${LAUNCHER_SCRIPT_TO_TEST} is run as an arbitrary user" {
52+
#GIVEN
53+
expected_msg="${not_root_msg} ${not_sudoer_msg} SUDO="
54+
55+
#WHEN
56+
run docker exec --user=${user} "${CONTAINER_NAME}" bash -c "${test_snippet}"
57+
58+
#THEN
59+
assert_success
60+
assert_output ${expected_msg}
61+
}
62+

‎agents/che-core-api-agent/src/test/resources/agents-launchers-tests.bats‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/usr/bin/env bats
2+
# Copyright (c) 2012-2017 Red Hat, Inc
3+
# All rights reserved. This program and the accompanying materials
4+
# are made available under the terms of the Eclipse Public License v1.0
5+
# which accompanies this distribution, and is available at
6+
# http://www.eclipse.org/legal/epl-v10.html
7+
#
8+
# Contributors:
9+
# Mario
10+
#
11+
# How to run this script:
12+
# cd <root of che local git repository>
13+
# export CHE_BASE_DIR=$(pwd)
14+
# export LAUNCHER_SCRIPT_TO_TEST=wsagent/agent/src/main/resources/org.eclipse.che.ws-agent.script.sh
15+
# export BATS_TEST_SCRIPT=agents/che-core-api-agent/src/test/resources/agents-launchers-tests.bats
16+
# export DOCKER_IMAGE=eclipse/centos_jdk8
17+
# docker run -ti --rm -e CHE_BASE_DIR -e LAUNCHER_SCRIPT_TO_TEST -e DOCKER_IMAGE \
18+
# -v ${CHE_BASE_DIR}/${BATS_TEST_SCRIPT}:/scripts/launcher_tests.bats \
19+
# -v ${CHE_BASE_DIR}/dockerfiles:/dockerfiles \
20+
# -v /var/run/docker.sock:/var/run/docker.sock \
21+
# eclipse/che-bats bats /scripts/launcher_tests.bats
22+
#
23+
24+
load '/bats-support/load.bash'
25+
load '/bats-assert/load.bash'
26+
. /dockerfiles/cli/tests/test_base.sh
27+
28+
CONTAINER_NAME="batssshscripttest"
29+
30+
script_host_path=${CHE_BASE_DIR}/${LAUNCHER_SCRIPT_TO_TEST}
31+
root_msg="I am root"
32+
not_root_msg="I am a not root"
33+
sudoer_msg="I am a sudoer"
34+
not_sudoer_msg="I am a not a sudoer"
35+
#test_snippet="source <(grep -iE -A3 'is_current_user_root\(\)|is_current_user_sudoer\(\)' /launch.sh | grep -v -- "^--$"); is_current_user_root && echo -n '${root_msg} ' || echo -n '${not_root_msg} '; is_current_user_sudoer && echo '${sudoer_msg}' || echo '${not_sudoer_msg}'"
36+
test_snippet="source <(grep -iE -A3 'is_current_user_root\(\)|is_current_user_sudoer\(\)|set_sudo_command\(\)' /launch.sh | grep -v -- "^--$"); is_current_user_root && echo -n '${root_msg} ' || echo -n '${not_root_msg} '; is_current_user_sudoer && echo -n '${sudoer_msg} ' || echo '${not_sudoer_msg}'; set_sudo_command; echo SUDO=\${SUDO}"
37+
38+
# Kill running che server instance if there is any to be able to run tests
39+
setup() {
40+
kill_running_named_container ${CONTAINER_NAME}
41+
remove_named_container ${CONTAINER_NAME}
42+
docker run --name="${CONTAINER_NAME}" -d -v ${script_host_path}:/launch.sh "${DOCKER_IMAGE}"
43+
}
44+
45+
teardown() {
46+
kill_running_named_container "${CONTAINER_NAME}"
47+
remove_named_container ${CONTAINER_NAME}
48+
}
49+
50+
@test "should deduce that's root and sudoer when ${LAUNCHER_SCRIPT_TO_TEST} is run as root" {
51+
#GIVEN
52+
user="root"
53+
expected_msg="${root_msg} ${sudoer_msg} SUDO="
54+
55+
#WHEN
56+
run docker exec --user=${user} "${CONTAINER_NAME}" bash -c "${test_snippet}"
57+
58+
#THEN
59+
assert_success
60+
# assert_output --partial ${expected_msg}
61+
assert_output ${expected_msg}
62+
}
63+
64+
@test "should deduce that's not root but sudoer when ${LAUNCHER_SCRIPT_TO_TEST} is run as user with UID 1000" {
65+
#GIVEN
66+
user="1000"
67+
expected_msg="${not_root_msg} ${sudoer_msg} SUDO=sudo -E"
68+
69+
#WHEN
70+
run docker exec --user=${user} "${CONTAINER_NAME}" bash -c "${test_snippet}"
71+
72+
#THEN
73+
assert_success
74+
# assert_output --partial ${expected_msg}
75+
assert_output ${expected_msg}
76+
}

‎agents/che-core-api-agent/src/test/resources/run_launcher_bats_tests.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
#!/bin/bash
2+
# Copyright (c) 2012-2017 Red Hat, Inc
3+
# All rights reserved. This program and the accompanying materials
4+
# are made available under the terms of the Eclipse Public License v1.0
5+
# which accompanies this distribution, and is available at
6+
# http://www.eclipse.org/legal/epl-v10.html
7+
#
8+
# Contributors:
9+
# Mario
10+
#
11+
# How to run this script:
12+
# cd <root of che local git repository>
13+
# sh agents/che-core-api-agent/src/test/resources/run_launcher_bats_tests.sh
14+
#
15+
16+
#images=(bitnami/che-codeigniter:3.1.3-r6 bitnami/che-express:4.15.3-r2 bitnami/che-java-play:1.3.12-r3 bitnami/che-laravel:5.4.23-r1 bitnami/che-rails:5.1.2-r0 bitnami/che-swift:3.1.1-r0 bitnami/che-symfony:3.3.2-r0 eclipse/centos_jdk8 eclipse/cpp_gcc eclipse/debian_jdk8 eclipse/debian_jre eclipse/dotnet_core eclipse/hadoop-dev eclipse/kotlin eclipse/node eclipse/php eclipse/php:5.6 eclipse/php:gae eclipse/selenium eclipse/ubuntu_android eclipse/ubuntu_go eclipse/ubuntu_jdk8 eclipse/ubuntu_jre eclipse/ubuntu_python:2.7 eclipse/ubuntu_python:gae_python2.7 eclipse/ubuntu_python:latest eclipse/ubuntu_rails kaloyanraev/che-zendserver registry.centos.org/che-stacks/centos-go registry.centos.org/che-stacks/centos-nodejs registry.centos.org/che-stacks/spring-boot registry.centos.org/che-stacks/vertx registry.centos.org/che-stacks/wildfly-swarm tomitribe/ubuntu_tomee_173_jdk8 registry.centos.org/che-stacks/centos-git)
17+
#arbitrary_images=(rhche/centos_jdk8 rhche/vertx rhche/ubuntu_jdk8 rhche/centos-nodejs rhche/spring-boot rhche/wildfly-swarm)
18+
images=(eclipse/centos_jdk8)
19+
arbitrary_images=(rhche/centos_jdk8)
20+
21+
run_bats_test() {
22+
export CHE_BASE_DIR=$(pwd)
23+
export BATS_TEST_SCRIPT=${1}
24+
export LAUNCHER_SCRIPT_TO_TEST=${2}
25+
export DOCKER_IMAGE=${3}
26+
docker run -ti --rm -e CHE_BASE_DIR -e LAUNCHER_SCRIPT_TO_TEST -e DOCKER_IMAGE \
27+
-v ${CHE_BASE_DIR}/${BATS_TEST_SCRIPT}:/scripts/launcher_tests.bats \
28+
-v ${CHE_BASE_DIR}/dockerfiles:/dockerfiles \
29+
-v /var/run/docker.sock:/var/run/docker.sock \
30+
eclipse/che-bats bats /scripts/launcher_tests.bats
31+
}
32+
33+
for image in "${images[@]}"; do
34+
launcher_script_to_test="wsagent/agent/src/main/resources/org.eclipse.che.ws-agent.script.sh"
35+
bats_test_script="agents/che-core-api-agent/src/test/resources/agents-launchers-tests.bats"
36+
echo "RUNNING LAUNCHER BATS TESTS FOR IMAGE ${image}"
37+
run_bats_test "${bats_test_script}" "${launcher_script_to_test}" "${image}"
38+
done
39+
40+
for arbitrary_image in "${arbitrary_images[@]}"; do
41+
launcher_script_to_test="wsagent/agent/src/main/resources/org.eclipse.che.ws-agent.script.sh"
42+
bats_test_script="agents/che-core-api-agent/src/test/resources/agents-launchers-tests-arbitraryuser.bats"
43+
echo "RUNNING LAUNCHER BATS TESTS FOR IMAGE ${arbitrary_image}"
44+
run_bats_test "${bats_test_script}" "${launcher_script_to_test}" "${arbitrary_image}"
45+
done

‎agents/exec/src/main/resources/org.eclipse.che.exec.script.sh‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,20 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12+
13+
is_current_user_root() {
14+
test "$(id -u)" = 0
15+
}
16+
17+
is_current_user_sudoer() {
18+
sudo -n true > /dev/null 2>&1
19+
}
20+
21+
set_sudo_command() {
22+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
23+
}
24+
1225
unset PACKAGES
13-
unset SUDO
1426
command -v tar >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" tar"; }
1527
CURL_INSTALLED=false
1628
WGET_INSTALLED=false
@@ -23,8 +35,6 @@ if [ ${CURL_INSTALLED} = false ] && [ ${WGET_INSTALLED} = false ]; then
2335
CURL_INSTALLED=true
2436
fi
2537

26-
test "$(id -u)" = 0 || SUDO="sudo -E"
27-
2838
CHE_DIR=$HOME/che
2939
LOCAL_AGENT_BINARIES_URI='/mnt/che/exec-agent/exec-agent-${PREFIX}.tar.gz'
3040
DOWNLOAD_AGENT_BINARIES_URI='${WORKSPACE_MASTER_URI}/agent-binaries/${PREFIX}/exec/exec-agent-${PREFIX}.tar.gz'

‎agents/ls-csharp/src/main/resources/org.eclipse.che.ls.csharp.script.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,21 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12+
is_current_user_root() {
13+
test "$(id -u)" = 0
14+
}
15+
16+
is_current_user_sudoer() {
17+
sudo -n true > /dev/null 2>&1
18+
}
19+
20+
set_sudo_command() {
21+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
22+
}
23+
1224
unset PACKAGES
13-
unset SUDO
1425
command -v tar >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" tar"; }
1526
command -v curl >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" curl"; }
16-
test "$(id -u)" = 0 || SUDO="sudo -E"
1727

1828
AGENT_BINARIES_URI=https://codenvy.com/update/repository/public/download/org.eclipse.che.ls.csharp.binaries
1929
CHE_DIR=$HOME/che

‎agents/ls-json/src/main/resources/org.eclipse.che.ls.json.script.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,21 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12+
is_current_user_root() {
13+
test "$(id -u)" = 0
14+
}
15+
16+
is_current_user_sudoer() {
17+
sudo -n true > /dev/null 2>&1
18+
}
19+
20+
set_sudo_command() {
21+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
22+
}
23+
1224
unset PACKAGES
13-
unset SUDO
1425
command -v tar >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" tar"; }
1526
command -v curl >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" curl"; }
16-
test "$(id -u)" = 0 || SUDO="sudo -E"
1727

1828
AGENT_BINARIES_URI=https://codenvy.com/update/repository/public/download/org.eclipse.che.ls.json.binaries
1929
CHE_DIR=$HOME/che

‎agents/ls-php/src/main/resources/org.eclipse.che.ls.php.script.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,21 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12+
is_current_user_root() {
13+
test "$(id -u)" = 0
14+
}
15+
16+
is_current_user_sudoer() {
17+
sudo -n true > /dev/null 2>&1
18+
}
19+
20+
set_sudo_command() {
21+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
22+
}
23+
1224
unset PACKAGES
13-
unset SUDO
1425
command -v tar >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" tar"; }
1526
command -v curl >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" curl"; }
16-
test "$(id -u)" = 0 || SUDO="sudo -E"
1727

1828
AGENT_BINARIES_URI=https://codenvy.com/update/repository/public/download/org.eclipse.che.ls.php.binaries
1929
CHE_DIR=$HOME/che

‎agents/ls-python/src/main/resources/org.eclipse.che.ls.python.script.sh‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,25 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12+
is_current_user_root() {
13+
test "$(id -u)" = 0
14+
}
15+
16+
is_current_user_sudoer() {
17+
sudo -n true > /dev/null 2>&1
18+
}
19+
20+
set_sudo_command() {
21+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
22+
}
23+
1224
unset PACKAGES
13-
unset SUDO
1425
unset PYTHON_DEPS
1526
command -v tar >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" tar"; }
1627
command -v curl >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" curl"; }
1728
command -v python3.5 >/dev/null 2>&1 || { PYTHON_DEPS=${PYTHON_DEPS}" python3.5"; }
1829
command -v pip3 >/dev/null 2>&1 || { PYTHON_DEPS=${PYTHON_DEPS}" pip3"; }
1930

20-
test "$(id -u)" = 0 || SUDO="sudo -E"
21-
2231
AGENT_BINARIES_URI=https://codenvy.com/update/repository/public/download/org.eclipse.che.ls.python.binaries
2332
CHE_DIR=$HOME/che
2433
LS_DIR=${CHE_DIR}/ls-python

‎agents/ls-typescript/src/main/resources/org.eclipse.che.ls.typescript.script.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,21 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12+
is_current_user_root() {
13+
test "$(id -u)" = 0
14+
}
15+
16+
is_current_user_sudoer() {
17+
sudo -n true > /dev/null 2>&1
18+
}
19+
20+
set_sudo_command() {
21+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
22+
}
23+
1224
unset PACKAGES
13-
unset SUDO
1425
command -v tar >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" tar"; }
1526
command -v curl >/dev/null 2>&1 || { PACKAGES=${PACKAGES}" curl"; }
16-
test "$(id -u)" = 0 || SUDO="sudo -E"
1727

1828
AGENT_BINARIES_URI=https://codenvy.com/update/repository/public/download/org.eclipse.che.ls.typescript.binaries
1929
CHE_DIR=$HOME/che

‎agents/ssh/src/main/resources/org.eclipse.che.ssh.script.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,19 @@
99
# Codenvy, S.A. - initial API and implementation
1010
#
1111

12-
unset SUDO
12+
is_current_user_root() {
13+
test "$(id -u)" = 0
14+
}
15+
16+
is_current_user_sudoer() {
17+
sudo -n true > /dev/null 2>&1
18+
}
19+
20+
set_sudo_command() {
21+
if is_current_user_sudoer && ! is_current_user_root; then SUDO="sudo -E"; else unset SUDO; fi
22+
}
23+
1324
unset PACKAGES
14-
test "$(id -u)" = 0 || SUDO="sudo -E"
1525

1626
if [ -f /etc/centos-release ]; then
1727
FILE="/etc/centos-release"

0 commit comments

Comments
 (0)