Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow running as arbitrary UID for unprivileged Container Environments (OpenShift) #10307

Open
rezemble opened this issue Jan 18, 2025 · 0 comments

Comments

@rezemble
Copy link

Is your feature request related to a problem? Please describe.

In order to be able to run Icinga in a context with indeterminate User IDs, such as OpenShift, the group-injection logic from icinga.cpp seems to be an obstacle:

  if (!pw) {
  	if (errno == 0) {
  		Log(LogCritical, "cli")
  			<< "Invalid user specified: " << user;
  		return EXIT_FAILURE;
  	} else {
  		Log(LogCritical, "cli")
  			<< "getpwnam() failed with error code " << errno << ", \"" << Utility::FormatErrorNumber(errno) << "\"";
  		return EXIT_FAILURE;
  	}
  }
  // also activate the additional groups the configured user is member of
  ...

Describe the solution you'd like

From my testing, activating additional groups in such a context is superfluous, since there are none; since the process is run as an arbitrary UID with GID 0, removing the if (!pw) { check and instead wrapping the group activating logic in

if (pw) {
 // also activate the additional groups the configured user is member of
 ...
}

works fine

Describe alternatives you've considered

I've considered wrapping the image with dynamic user and group renaming, but this adds unnecessary complexity and image layers

@rezemble rezemble changed the title Allow Running as Arbitrary UID for unprivileged Container Environments (OpenShift) Allow running as arbitrary UID for unprivileged Container Environments (OpenShift) Jan 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant