aws / aws/amazon-ssm-agent

ssm agent creating folders with wrong permissions

Open
#286 8 comments 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

OS: Ubuntu 16.04
Agent version: v2.3.1319.0
Downloaded from https://s3.us-west-2.amazonaws.com/amazon-ssm-us-west-2/latest/debian_amd64/amazon-ssm-agent.deb

when amazon-ssm-agent starts, it creates folders in /var/lib/amazon/ssm w/ the execute bit off. Eg:

```
# ls -l /var/lib/amazon/ssm
total 24
drw------- 2 root root 4096 Jun 10 20:21 daemons
drw------- 3 root root 4096 Jun 10 20:21 localcommands
drw------- 6 root root 4096 Jun 10 20:21 mi-035a1646cxxxxxxx
-rw------- 1 root root 65 Jun 10 20:20 registration
drw------- 3 root root 4096 Jun 10 20:20 Vault
```
Notice all the folders has permission of `rw` instead of the standard `rwx`. While this is not an issue since the agent run as root, this is a problem if I run the agent as non-root.

When running the agent as non-root, it results in an error as the process cannot `chdir` into the folders since the folders are missing the execute bit. Here's the error from syslog:

```
Jun 10 19:53:32 ubuntu-1604 systemd[1]: Started amazon-ssm-agent.
Jun 10 19:53:33 ubuntu-1604 amazon-ssm-agent[1162]: 2020/06/10 19:53:33 Failed to load instance info from vault. Failed to set permission for vault folder or its content. chown /var/lib/amazon/ssm/Vault: operation not permitted
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the startup on Ubuntu 16.04 with the agent running as a non-root user, then trace the folder-creation and permission handling involved in /var/lib/amazon/ssm and its Vault directory. Done means created directories retain the execute bit and the agent can start and change into them without the reported permission error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux, ubuntu
Domain
backend, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.