ssm agent creating folders with wrong permissions
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
OS: Ubuntu 16.04
Agent version: v2.3.1319.0
Downloaded from https://s3.us-west-2.amazonaws.com/amazon-ssm-us-west-2/latest/debian_amd64/amazon-ssm-agent.deb
when amazon-ssm-agent starts, it creates folders in /var/lib/amazon/ssm w/ the execute bit off. Eg:
```
# ls -l /var/lib/amazon/ssm
total 24
drw------- 2 root root 4096 Jun 10 20:21 daemons
drw------- 3 root root 4096 Jun 10 20:21 localcommands
drw------- 6 root root 4096 Jun 10 20:21 mi-035a1646cxxxxxxx
-rw------- 1 root root 65 Jun 10 20:20 registration
drw------- 3 root root 4096 Jun 10 20:20 Vault
```
Notice all the folders has permission of `rw` instead of the standard `rwx`. While this is not an issue since the agent run as root, this is a problem if I run the agent as non-root.
When running the agent as non-root, it results in an error as the process cannot `chdir` into the folders since the folders are missing the execute bit. Here's the error from syslog:
```
Jun 10 19:53:32 ubuntu-1604 systemd[1]: Started amazon-ssm-agent.
Jun 10 19:53:33 ubuntu-1604 amazon-ssm-agent[1162]: 2020/06/10 19:53:33 Failed to load instance info from vault. Failed to set permission for vault folder or its content. chown /var/lib/amazon/ssm/Vault: operation not permitted
```
Contributor guide
Research direction
Reproduce the startup on Ubuntu 16.04 with the agent running as a non-root user, then trace the folder-creation and permission handling involved in /var/lib/amazon/ssm and its Vault directory. Done means created directories retain the execute bit and the agent can start and change into them without the reported permission error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux, ubuntu
- Domain
- backend, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100