Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ATS 9.2.6 fails to start as root #11869

Open
jvgutierrez opened this issue Nov 15, 2024 · 2 comments · May be fixed by #11872
Open

ATS 9.2.6 fails to start as root #11869

jvgutierrez opened this issue Nov 15, 2024 · 2 comments · May be fixed by #11872

Comments

@jvgutierrez
Copy link
Member

As a side effect of #11855 ATS is now unable to start as root:

traffic_manager uses ImpersonateUser() to drop privileges triggering the following syscalls:

450941 setgroups(1, [123])              = 0
450941 setresgid(-1, 123, -1)           = 0
450941 setresuid(-1, 118, -1)           = 0

afterwards traffic_server attempts to drop privileges as well but setgroups fails due to lack of permissions:

450952 setgroups(1, [123])              = -1 EPERM (Operation not permitted)
@jvgutierrez
Copy link
Member Author

-  if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
-    Fatal("switching to user %s, failed to initialize supplementary groups ID %ld", pwd->pw_name, (long)pwd->pw_gid);
+  if (geteuid() == 0) {
+    if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
+      Fatal("switching to user %s, failed to initialize supplementary groups ID %ld", pwd->pw_name, (long)pwd->pw_gid);
+    }

could be a potential solution for this, @maskit what do you think?

@maskit
Copy link
Member

maskit commented Nov 15, 2024

Oh, traffic_manager... Yeah, it's an oversight and there was no intention to make ATS unable to start as root. Would you make a PR?

jvgutierrez added a commit to jvgutierrez/trafficserver that referenced this issue Nov 15, 2024
jvgutierrez added a commit to jvgutierrez/trafficserver that referenced this issue Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants