Ilker ManapandClaude Opus 5.5
2d47427cdc
The supervisor drops to the run_as user (default llmgw-engine) when the agent is root: its credential and groups, a 0700 home under the work directory as the working directory, HOME and XDG_CACHE_HOME there. A node without the user keeps engines as root and logs why. node add creates the user in the video and render groups. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package supervisor
|
|
|
|
import (
|
|
"os"
|
|
"os/exec"
|
|
"os/user"
|
|
"path/filepath"
|
|
"slices"
|
|
"strconv"
|
|
"syscall"
|
|
"testing"
|
|
)
|
|
|
|
func TestAnEngineIsGivenItsUsersCredentialHomeAndCaches(t *testing.T) {
|
|
me, err := user.Current()
|
|
if err != nil {
|
|
t.Skip(err)
|
|
}
|
|
work := filepath.Join(t.TempDir(), "agent")
|
|
if err := os.MkdirAll(work, 0o750); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r, err := credentialFor(me, work)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
uid, _ := strconv.Atoi(me.Uid)
|
|
if int(r.cred.Uid) != uid || r.home != filepath.Join(work, "engine-home") {
|
|
t.Fatalf("%+v", r)
|
|
}
|
|
if st, err := os.Stat(r.home); err != nil || st.Mode().Perm() != 0o700 {
|
|
t.Errorf("home: %v %v", st.Mode(), err)
|
|
}
|
|
s := &Supervisor{cfg: Config{WorkDir: work}, as: r}
|
|
c := exec.Command("true")
|
|
c.Env = []string{"HOME=/root", "PATH=/bin"}
|
|
c.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
|
|
s.dropTo(c)
|
|
if c.SysProcAttr.Credential == nil || c.Dir != r.home || !slices.Contains(c.Env, "HOME="+r.home) {
|
|
t.Errorf("dir %s env %v cred %v", c.Dir, c.Env, c.SysProcAttr.Credential)
|
|
}
|
|
}
|
|
|
|
func TestNotRootOrNoSuchUserLeavesEnginesAsTheAgent(t *testing.T) {
|
|
if os.Geteuid() == 0 {
|
|
t.Skip("run as root")
|
|
}
|
|
if r, why := resolveRunAs(DefaultRunAs, t.TempDir()); r != nil || why != "" {
|
|
t.Errorf("not root: %v %q", r, why)
|
|
}
|
|
}
|