fix(core): bundling directory access permission is too restrictive #8767
Conversation
misterjoshua
changed the title
misterjoshua
changed the title
|
@jogold can you take a look at this please? |
| @@ -144,6 +144,9 @@ export class AssetStaging extends Construct { | |||
|
|
|||
| // Create temp directory for bundling inside the temp staging directory | |||
| const bundleDir = path.resolve(fs.mkdtempSync(path.join(stagingTmp, 'asset-bundle-'))); | |||
| // Chmod the bundleDir to full access after applying the process the umask. | |||
| // tslint:disable-next-line:no-bitwise | |||
| fs.chmodSync(bundleDir, 0o777 & (~process.umask())); | |||
There was a problem hiding this comment.
Looks like calling process.umask() with no argument is now deprecated in Node.js v14: https://nodejs.org/docs/latest-v14.x/api/process.html#process_process_umask
What would be the alternative? What about using only 0o777, would it be OK?
There was a problem hiding this comment.
Another alternative is to set a new umask (to get the return value), then restore the original umask. I've seen a getumask manpage that describes this approach. But, mode 0o777 alone would certainly satisfy my use case. I can't think of any major downsides. What's your preference?
There was a problem hiding this comment.
But, mode
0o777alone would certainly satisfy my use case. I can't think of any major downsides.
OK, let's go for this.
misterjoshua
changed the title
|
@eladb LGTM, maybe change the PR title to something like |
eladb
changed the title
eladb
changed the title
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
The new bundler uses
mkdtempSyncto pre-create uniquely named directories for asset staging. But,mkdtempSynccreates the staging directories with a restrictive0700 & ~umaskmode, rather thanmkdir's usual0777 & ~umaskmode.In Bitbucket Pipelines, these restrictive permissions prevent the bundler from accessing its
/asset-outputvolume. And, if the bundler can't access/asset-output, bundling fails.This fix chmods the asset staging directory to 0777. This change fixes my Bitbucket Pipelines issue.
Closes #8757
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license