'run_as_user' failed to run in controlled environment

[rabsr]

Apache Airflow version:
1.10.9

What happened:
The task run command fails as temp config file generated does not have read permission for user when run_as_user argument is used. The file does not have permission as the environment does not have sudo privileges to change owner.

What you expected to happen:

The temp config file generated can have '644' or '640' permissions to allow users read file in case when change owner is not permitted.

How to reproduce it:
Schedule a task with 'run_as_user' enabled and have sudo privileges restricted to change owner.

[rabsr]

@mik-laj Is there any specific reason to only have 600 permissions? Also, what if 'sudo' is not supported and just support 'pbrun' commands?

[mik-laj]

600 because we have passwords and secrets in this file, so we're still trying to get the most narrow permissions possible. If you want to introduce new feature, I invite you to create PR.
Contributor guide:
https://github.com/apache/airflow/blob/master/CONTRIBUTING.rst
Development environment guide:
https://github.com/apache/airflow/blob/master/BREEZE.rst

[ashb]

I think this is a won't fix. Without sudo how can you run tasks as another user anyway?

[rabsr]

In our environment, we are using power broker which restrict direct usage of sudo commands and pbrun commands are required.

However, Custom Task Runner feature solves our problem #8067 . Hence closing the issue.

PowerBroker references:

1. https://access.redhat.com/ecosystem/software/1469583
2. https://unix.stackexchange.com/questions/187663/what-is-difference-between-pbrun-and-sudo-command