1199379 - TC jobs are all running as root (need option to run as non-root)

Status: RESOLVED FIXED

(Taskcluster :: Workers, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Running 'id' in the current image:

https://tools.taskcluster.net/task-inspector/#GVKdGQcmT3KDBVtIIUQrHQ/0
uid=0(root) gid=0(root) groups=0(root)

So, yeah.  This caused some particularly weird errors when running plugin-container on CentOS 6.  I don't know how (or if, TBH) it worked on Ubuntu.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Attachment: MozReview Request: Bug 1199379: drop root before beginning the build r?ted.mielczarek

Bug 1199379: don't build as root, and verify r?ted

Comment 2

[(not currently active) Ted Mielczarek]

Comment on attachment 8653660 [details]
MozReview Request: Bug 1199379: drop root before beginning the build r?ted.mielczarek

https://reviewboard.mozilla.org/r/17479/#review15603

Good call!

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8653660 [details]
MozReview Request: Bug 1199379: drop root before beginning the build r?ted.mielczarek

Bug 1199379: don't build as root, and verify r?ted.mielczarek

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Actually, I'm going to hold off on this.  It turns out that *everything* runs as root in TaskCluster, and caches don't work with non-root users.  So the current setup builds stuff as root, which mostly works; if I land this patch, then nothing will work.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

A workaround will be to have build-linux.sh chmod the relevant folders, then su - to worker and re-run itself.  I'll see if i can make that work.

Comment 6

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

(In reply to Dustin J. Mitchell [:dustin] from comment #0)
> So, yeah.  This caused some particularly weird errors when running
> plugin-container on CentOS 6.  I don't know how (or if, TBH) it worked on
> Ubuntu.

We have an idea: /home/worker is mode 0700 in the CentOS image but mode 0755 in the Ubuntu image, and the root-owned plugin-container that had given up its superuser powers was treated as "other" in those permissions, so it broke on CentOS but would still work on Ubuntu.

Comment 7

[Dustin J. Mitchell [:dustin] (he/him)]

I'd rather not build as root, all other things being equal.  So I think fixing that is the better solution, rather than convincing firefox to build and run as root.

I'm about to put another review request up for that workaround.  Sorry for the multiple review reqs!

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8653660 [details]
MozReview Request: Bug 1199379: drop root before beginning the build r?ted.mielczarek

Bug 1199379: drop root before beginning the build r?ted.mielczarek

This requires doing some cleanup of permissions on the cache mounts first;
eventually, this should be done by the docker-worker.

Comment 9

[(not currently active) Ted Mielczarek]

Comment on attachment 8653660 [details]
MozReview Request: Bug 1199379: drop root before beginning the build r?ted.mielczarek

https://reviewboard.mozilla.org/r/17479/#review15851

Bummer that you have to leave all those FIXMEs in, but at least you have bugs on file.

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

With that landed, this no longer blocks bug 1189892, but needs a more complete solution.

Comment 11

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c82573f56056

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c82573f56056

Comment 13

[Greg Arndt [:garndt]]

I believe this has largely been solved by running as another user and chown-ing the workspace directories correctly.  Reopen with comments if this has not been solved.

Comment 14

[Dustin J. Mitchell [:dustin] (he/him)]

The idea was that we would not run tasks as root by default, but it really doesn't seem to be bothering anyone, so maybe we can just leave it as-is.

Comment 15

[Firefox Bug Husbandry Bot]

Removing leave-open keyword from resolved bugs, per :sylvestre.