aws / aws/amazon-ssm-agent

loginuid is unset on ssm sessions

Open
#437 0 comments 5 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

I was setting up some auditing for ssm sessions, and I noticed ssm-session-worker doesn't set loginuid.
pstree:
```
|-amazon-ssm-agen,838
| |-ssm-agent-worke,898
| | |-ssm-session-wor,18199
| | | |-sh,18212
```
loginuid:
```
$ cat /proc/838/loginuid ; echo
4294967295
$ cat /proc/898/loginuid ; echo
4294967295
$ cat /proc/18199/loginuid ; echo
4294967295
```
On the other hand, with ssh I have:
pstree:
```
|-sshd,709
| `-sshd,17277
| `-sshd,17281
| `-bash,17282
```
loginuid:
```
$ cat /proc/709/loginuid ; echo
4294967295
$ cat /proc/17277/loginuid ; echo
1000
$ cat /proc/17281/loginuid ; echo
1000
```

I would expect `ssm-session-worker` to have loginuid set to ssm-user uid.

Contributor guide

Open the contributing guide

Research direction

Start at the ssm-session-worker entry point and trace how SSM sessions launch the shell for ssm-user. Reproduce the issue by comparing /proc//loginuid for an SSM session with the SSH examples in the report. Done means the session worker and its descendants expose loginuid set to the ssm-user UID, with coverage for the launch path.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.