1375165 - Replace worker configuration "runTasksAsCurrentUser" with task feature "runAsWorkerUser"

Status: RESOLVED WONTFIX

(Taskcluster :: Workers, enhancement)

Description

[Pete Moore [:pmoore][:pete]]

This is a tracker bug for implementing and rolling out this feature.

Until now, in order to support worker CI, we created a worker configuration setting "runTasksAsCurrentUser" that would cause tasks running on that worker type not to run as an isolated OS task user created especially for that task, but instead to run as the same OS user that the generic-worker process is running as. This is needed by the generic-worker CI itself since the CI launches generic-worker processes, and they need to run in the same security context as a real generic-worker would (e.g. on Windows this means running as LocalSystem under a windows service).

The downside of this approach is it means we need to maintain and support additional worker types. Instead, this could be a task feature, protected by a scope.

We can still create separate worker types if we decide not to accept the security risk of allowing privileged tasks to run on the same workers as non-privileged tasks, or even disable the feature via a separate worker type configuration setting - but implementing as a task feature gives us the opportunity to manage few worker types, and choose whether we want pool separation or not.

This is just a tracking bug for the migration - the individual work items will sit underneath this bug as dependencies.

Comment 1

[Chris Cooper [:coop] (he/him)]

Work continues in dependent bugs.

Comment 2

[Pete Moore [:pmoore][:pete]]

Closing - see bug 1375170 comment 2 for context.