Azure / Azure/LinuxPatchExtension

Extension seems to unnecessarily checks if it has "sudo" access

未关闭
#381 0 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
12
派生
20
平均合并
6 天 4 小时
30 天内合并 PR
1

描述

Based on public docs everything the waagent runs, including VM extensions, are executed as root: https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/features-linux?tabs=azure-cli#agent-permissions

I checked the source code and found the method EnvHealthManager.check_sudo_status that basically runs a "sudo id" command and checks if it gets a prompt for root password ("[sudo] password for username"). If so, the error "Sudo status check failed..." is raised and LinuxPatchExtension installation fails. Why?

I see there is an argument named raise_if_not_sudo that can skip /etc/sudoers validation, but it is hardcoded to "True" and I did not find anyway to replace it to False without manually changing extension binary.

Is it possible to add a setting in the waagent or LinuxPatchExtension config file to change this raise_if_not_sudo to False? I did not find anyway to do it without manually changing extension binary. The EXT will be executed as root, so why this is set to True? Is there any scenario the EXT does not run as root?

贡献指南

打开贡献指南

调研方向

首先阅读 EnvHealthManager.check_sudo_status,以及将 raise_if_not_sudo 硬编码为 True 的代码路径。查看 issue 中提到的 LinuxPatchExtension 和 waagent 配置参考,然后确定受支持的配置路径。验证在禁用 sudoers 验证时,安装可以跳过该验证且不会破坏默认行为。

由索引模型根据 Issue 内容生成。

评估

技术栈
azure, python
领域
cloud, devops
Issue 类型
功能
难度
4/5
预计耗时
3-5 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。