feat(execd): support uid and gid for command execution#372
feat(execd): support uid and gid for command execution#372liuxiaopai-ai wants to merge 1 commit intoalibaba:mainfrom
Conversation
liuxiaopai-ai
requested review from
Pangjiping,
hittyt,
jwx0925 and
ninan-nn
as code owners
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2bbc08246c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| credential := &syscall.Credential{ | ||
| Uid: uint32(os.Getuid()), | ||
| Gid: uint32(os.Getgid()), | ||
| } |
There was a problem hiding this comment.
Creating syscall.Credential without NoSetGroups: true makes Go call setgroups(0, nil) whenever uid/gid is provided, and that fails with operation not permitted in non-root execd deployments even if the requested IDs equal the current user/group. This means the new uid/gid feature can break command start for common hardened setups that run execd as an unprivileged user; please set NoSetGroups (or explicitly manage groups) when building the credential.
Useful? React with 👍 / 👎.
|
same as #332 |
2 participants
Summary
uidandgidfields to execd command requests and OpenAPI schemauid/gidon Windows with a clear errorCloses #178
Testing
cd sdks/sandbox/python && uv run pytest tests/test_converters_and_error_handling.pycd sdks/sandbox/javascript && pnpm buildgo test ./...cd sdks/sandbox/kotlin && ./gradlew test --tests '*CommandsAdapterTest'dotnet test sdks/sandbox/csharp/tests/OpenSandbox.Tests/OpenSandbox.Tests.csproj --filter "CommandsAdapterTests|ModelsTests"Notes
gois not installed in this environment, so execd Go tests could not be run locally.dotnetis not installed in this environment, so C# tests could not be run locally.