loginuid is unset on ssm sessions
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
I was setting up some auditing for ssm sessions, and I noticed ssm-session-worker doesn't set loginuid.
pstree:
```
|-amazon-ssm-agen,838
| |-ssm-agent-worke,898
| | |-ssm-session-wor,18199
| | | |-sh,18212
```
loginuid:
```
$ cat /proc/838/loginuid ; echo
4294967295
$ cat /proc/898/loginuid ; echo
4294967295
$ cat /proc/18199/loginuid ; echo
4294967295
```
On the other hand, with ssh I have:
pstree:
```
|-sshd,709
| `-sshd,17277
| `-sshd,17281
| `-bash,17282
```
loginuid:
```
$ cat /proc/709/loginuid ; echo
4294967295
$ cat /proc/17277/loginuid ; echo
1000
$ cat /proc/17281/loginuid ; echo
1000
```
I would expect `ssm-session-worker` to have loginuid set to ssm-user uid.
Contributor guide
Research direction
Start at the ssm-session-worker entry point and trace how SSM sessions launch the shell for ssm-user. Reproduce the issue by comparing /proc//loginuid for an SSM session with the SSH examples in the report. Done means the session worker and its descendants expose loginuid set to the ssm-user UID, with coverage for the launch path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100