Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run lxc commands as non root by default #56

Merged
merged 2 commits into from Nov 26, 2020

Conversation

lucasmoura
Copy link
Contributor

@lucasmoura lucasmoura commented Nov 18, 2020

In ubuntu-advantage-tools, we require some LXD commands to be run as non-root. This PR changes the default behavior of LXD to run exec commands as non-root.

This will impact some cloud-init tests, but we already have a PR to handle that

@TheRealFalcon
Copy link
Member

Actually...lxd is the exception for us as all other clouds already execute non-root. This may actually simplify things for us 🙂

Copy link
Member

@TheRealFalcon TheRealFalcon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Travis is failing as this will break cloud-init tests, but once canonical/cloud-init#664 lands it should be a one-line fix. Since we've pinned our pycloudlib version, I'm not concerned these failures.

Copy link
Collaborator

@blackboxsw blackboxsw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once canonical/cloud-init#694 lands, this looks good to land

Copy link
Contributor

@OddBloke OddBloke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The conclusion we came to in canonical/cloud-init#664 was that pycloudlib should consistently execute commands as an unprivileged user by default. This aligns LXD with the other clouds in pycloudlib which use SSH.

Copy link
Contributor

@OddBloke OddBloke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per canonical/cloud-init#694 (comment), running commands as UID 1000 is not the same as running commands as self.username. I believe this will need modification to look up the UID of self.username before running lxc exec for the first time.

@lucasmoura
Copy link
Contributor Author

@OddBloke I have updated the code to get the user id before running any lxc exec commands.

The solution I have is to retry the id -u command until the user was created. With that solution, I think we can drop from LXD the call for _wait_for_execute, since the user_id property is kind of covering that already

Copy link
Contributor

@OddBloke OddBloke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@lucasmoura lucasmoura merged commit 7532404 into canonical:master Nov 26, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants