feat: preserve original user environment when running under sudo #5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![blink-so[bot]](https://avatars.githubusercontent.com/in/1271127?s=80&v=4){kind=small}
When jail is executed with sudo, the subprocess now receives the original user's environment variables (USER, HOME, PATH, XDG directories) instead of root's environment. This ensures that tools and applications behave as if they were run by the original user. Changes: - Add environment package with sudo detection and user environment restoration - Update Linux jail implementation to restore user environment - Update macOS jail implementation to restore user environment - Preserve important variables: USER, LOGNAME, HOME, PATH, XDG_* directories - Maintain backward compatibility for non-sudo execution Co-authored-by: f0ssel <[email protected]>
The time import was accidentally added during the environment restoration implementation but is not actually used in the macOS network code. Fixes CI build failure on macOS. Co-authored-by: f0ssel <[email protected]>
Improved the PATH restoration logic to be more comprehensive: - Added more system paths including sbin directories - Added common user tool paths (Rust, Go, npm global) - Better preservation of tool paths from current PATH (/opt, /snap/bin) - Added duplicate removal while preserving path order - Enhanced debug logging for PATH restoration process This should help resolve issues where user-installed tools like 'claude' are not found when running jail with sudo. Co-authored-by: f0ssel <[email protected]>
This is the core fix for sudo environment preservation. Previously, we were only restoring environment variables but the subprocess was still running as root. Now we properly drop privileges to the original user. Changes: - Linux: Use syscall.Credential to set UID/GID of subprocess - macOS: Use syscall.Credential to set UID/GID, preserve original group behavior for non-sudo - Both platforms now check SUDO_USER and drop privileges accordingly - Added proper error handling and debug logging for privilege dropping Now 'sudo jail -- whoami' will return the original username instead of 'root'. Co-authored-by: f0ssel <[email protected]>
When running under sudo, the CA certificate was being stored in root's home directory (/root/.config/boundary/) but the subprocess running as the original user couldn't access it, causing certificate verification errors. Now GetConfigDir() detects sudo execution and uses the original user's home directory, so the CA certificate is stored in a location accessible to the subprocess. Fixes curl errors like: 'error setting certificate verify locations: CAfile: /Users/user/.config/boundary/ca-cert.pem' Co-authored-by: f0ssel <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
When jail is executed with
sudo, the subprocess receives root's environment variables instead of the original user's environment. This causes issues where:USER,HOME,LOGNAMEare set to root valuesPATHuses root's paths instead of user pathsSolution
This PR adds automatic detection and restoration of the original user's environment when running under sudo:
New Features
SUDO_USERenvironment variableUSER,LOGNAME: Original usernameHOME: Original user's home directoryPATH: Reconstructed path including user-specific directoriesXDG_*: XDG Base Directory variables for proper application data storageUID,GID: Original user's numeric IDsImplementation
environmentpackage with sudo detection and restoration logicUsage
Users can now run jail with sudo transparently:
Testing
The implementation has been tested to ensure: