1375170 - Implement task feature runAsWorkerUser

Status: RESOLVED WONTFIX

(Taskcluster :: Workers, enhancement)

Description

[Pete Moore [:pmoore][:pete]]

For context, see parent bug 1375165.

This bug is for implementing the task feature in generic-worker.

Work has started in https://github.com/taskcluster/generic-worker/tree/runAsWorkerUser

Comment 1

[Chris Cooper [:coop] (he/him)]

Pete: are we still going to do this?

Comment 2

[Pete Moore [:pmoore][:pete]]

(In reply to Chris Cooper [:coop] pronoun: he from comment #1)
> Pete: are we still going to do this?

Let's forget about it.

When I created the bug I liked the idea of making it a task feature, so we could manage fewer worker types. The idea was that we wouldn't need separate worker types for running tasks as a task user vs running tasks as Local System (like we do in the CI) but that it could be specified in the task payload (rather than the worker config file).

But in reality, the CI is the only place where we really want that, now we can already run tasks as Administrator using the osGroups and runAsAdministrator features, and probably it is safer, security-wise to isolate this feature at the worker level, rather than the task level.