1499051 - Run tasks under unique OS user accounts on darwin (macOS)

Status: RESOLVED FIXED

(Taskcluster :: Workers, task, P2)

Description

[Pete Moore [:pmoore][:pete]]

Currently, tasks run as the worker user on darwin (macOS).

Work started in https://github.com/taskcluster/generic-worker/blob/844b6421b643c40dab759c7ff907c95a67db57f7/plat_darwin.go to create individual task OS users per task but this code is incomplete and unused.

Comment 1

[Kendall Libby [:fubar] (he/him)]

CCing Jake, as he's been recently fighting with macOS things, including user creation, in Mojave and might have some input.

Comment 2

[Chris Cooper [:coop] (he/him)]

Pete is going to pick this up next week.

Some guidance for Pete: not everything needs to work under task/user isolation to start. For a first pass, I would focus on only the features required to run the PGO task on Mac (bug 1528374). :chmanchester can probably help with that.

Comment 3

[Jake Watkins [:dividehex]]

:pete, could we get away with not setting passwords for dynamically created users?

Also, as just a heads up, when it comes to gw on mojave, we might need to start signing the binaries in order to make calls certain calls to dscl. On yosemite, it should be no issue but on Mojave the OS enforces certain security parameters that can't easily be overridden.

Comment 4

[Chris Peterson [:cpeterson]]

Pete, do you have any updates on macOS user isolation for the PGO worker pool?

Comment 5

[Pete Moore [:pmoore][:pete]]

(In reply to Jake Watkins [:dividehex] from comment #3)

:pete, could we get away with not setting passwords for dynamically created users?

Potentially we could, although that isn't how I was intending to implement. Can you share a bit of detail about why that would be preferred?

Also, as just a heads up, when it comes to gw on mojave, we might need to start signing the binaries in order to make calls certain calls to dscl. On yosemite, it should be no issue but on Mojave the OS enforces certain security parameters that can't easily be overridden.

Thanks for the heads up. At the moment, the releases on github are not signed, but we do download them to the puppet master for propogation to the workers, so we could perhaps sign the version hosted on the puppet master, until we have automated signing the versions on github releases. But I'll look into creating signed releases on github too at some point, which would be best.

Comment 6

[Pete Moore [:pmoore][:pete]]

(In reply to Chris Peterson [:cpeterson] from comment #4)

Pete, do you have any updates on macOS user isolation for the PGO worker pool?

Hi Chris, I'm working on this now, and hope to have something ready in the next couple of weeks.

Comment 7

[Pete Moore [:pmoore][:pete]]

Attachment: GitHub Pull Request for generic-worker

This is where the development is being done. The PR isn't ready for review yet, but adding the link for those who may wish to monitor progress.

Comment 8

[Pete Moore [:pmoore][:pete]]

Hi Jake, re: comment 5. Thanks!

Comment 9

[Pete Moore [:pmoore][:pete]]

Finally ready for review!

https://github.com/taskcluster/generic-worker/pull/202

Comment 10

[Pete Moore [:pmoore][:pete]]

Released in generic-worker 15.0.0.

Comment 11

[Pete Moore [:pmoore][:pete]]

For those installing the new generic-worker, please pay special attention to the updated installation instructions.

Any problems/issues, let me know!

Comment 12

[Pete Moore [:pmoore][:pete]]

I'm reopening this bug, as I've found a bug (bug 1560388) which will need fixing before we go to production...

Comment 13

[Pete Moore [:pmoore][:pete]]

Blocking bug has now been fixed, so closing this bug too.

Released in generic-worker 15.1.0.

Comment 14

[Pete Moore [:pmoore][:pete]]

Jake, see comment 11 for installation instructions. Thanks!

Comment 15

[Jake Watkins [:dividehex]]

(In reply to Pete Moore [:pmoore][:pete] from comment #14)

Jake, see comment 11 for installation instructions. Thanks!

Thanks, Pete!