Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sts assumes ~/.cache directory exists #3

Open
kfiresmith opened this issue Feb 14, 2024 · 0 comments
Open

sts assumes ~/.cache directory exists #3

kfiresmith opened this issue Feb 14, 2024 · 0 comments

Comments

@kfiresmith
Copy link

kfiresmith commented Feb 14, 2024

Hi Folks,
When attempting to run sts as a newly created system user with a non-skeletonized home directory, I discovered that sts assumes that ~/.cache already exists and is available to create sts-client-id.txt within.

Here's what I observed:

$ /opt/sts/bin/sts 
panic: open /opt/<service-account-name>/.cache/sts-client-id.txt: no such file or directory

goroutine 1 [running]:
main.runFromServer({0xc69a20, 0x7b})
        /dap/apps/godev/src/sts/main/controlled.go:166 +0xd14
main.main()
        /dap/apps/godev/src/sts/main/app.go:50 +0x2c

$ mkdir /opt/<service-account-name>/.cache

$ /opt/sts/bin/sts 
2024-02-14T21:10:38Z [Server: a2e.energy.gov:443]
2024-02-14T21:10:39Z [Server Prefix: /_upload]
2024-02-14T21:10:39Z [Client ID: 02c9adfa-fab8-49fe-b448-98dee2ceeeed:5da4a8da-820f-4697-8c03-4ad1d3ca8b17]
2024-02-14T21:10:39Z [Cache Directory: /opt/<service-account-name>/.cache/sts]
2024-02-14T21:10:39Z [Client disabled: 02c9adfa-fab8-49fe-b448-98dee2ceeeed:5da4a8da-820f-4697-8c03-4ad1d3ca8b17]

I believe that sts should do one of the following depending on the developer's design philosophy:

  1. Error out with a succinct and syslog-friendly single-line error message that explains that ~/.cache doesn't exist and needs to be created to allow sts to cache files, obfuscating the multi-line Go traceback.
  2. Attempt to create the ~/.cache directory with the correct ownership and and appropriately conservative mode, probably 0700 to ensure we aren't creating a directory that STIG benchmarks would consider to be too open.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant