Allow Linux setuid/setgid #646

christopher-conley · 2023-07-23T03:12:49Z

This commit allows webhook to setuid/setgid when running on Linux. It bumps the version dependency for modules golang.org/x/net and golang.org/x/sys to v0.7.0 (for both), removes the Linux GOO from droppriv_nope.go, and removes the Linux GOO negation from droppriv_unix.go.

Tested with:

go get -d

CGO_ENABLED=0 go build -ldflags="-s -w"

Webhook compiled correctly, launched & went resident, setuid/setgid properly according the parameters fed to it, and correctly answered hook requests.

Forgot to include the test result:

builder@S4HRH9BLKDKBXTD:~/git/webhook/test$ go test ./..
ok      github.com/adnanh/webhook       12.079s

And here's the verbose test output:

builder@S4HRH9BLKDKBXTD:~/git/webhook/test$ go test ./..
=== RUN   TestStaticParams
--- PASS: TestStaticParams (0.00s)
=== RUN   TestWebhook
=== RUN   TestWebhook/github@test/hooks.json.tmpl
=== RUN   TestWebhook/github-multi-sig@test/hooks.json.tmpl
=== RUN   TestWebhook/github-multi-sig-fail@test/hooks.json.tmpl
=== RUN   TestWebhook/bitbucket@test/hooks.json.tmpl
=== RUN   TestWebhook/gitlab@test/hooks.json.tmpl
=== RUN   TestWebhook/xml@test/hooks.json.tmpl
=== RUN   TestWebhook/txt-raw@test/hooks.json.tmpl
=== RUN   TestWebhook/payload-json-array@test/hooks.json.tmpl
=== RUN   TestWebhook/slash-in-hook-id@test/hooks.json.tmpl
=== RUN   TestWebhook/multipart@test/hooks.json.tmpl
=== RUN   TestWebhook/issue-471@test/hooks.json.tmpl
=== RUN   TestWebhook/issue-471-and@test/hooks.json.tmpl
=== RUN   TestWebhook/missing-cmd-arg@test/hooks.json.tmpl
=== RUN   TestWebhook/missing-env-arg@test/hooks.json.tmpl
=== RUN   TestWebhook/empty-payload-signature@test/hooks.json.tmpl
=== RUN   TestWebhook/request-source@test/hooks.json.tmpl
=== RUN   TestWebhook/global_disallowed_method@test/hooks.json.tmpl
=== RUN   TestWebhook/disallowed_method@test/hooks.json.tmpl
=== RUN   TestWebhook/empty_payload@test/hooks.json.tmpl
=== RUN   TestWebhook/empty_payload@test/hooks.json.tmpl#01
=== RUN   TestWebhook/empty_payload@test/hooks.json.tmpl#02
=== RUN   TestWebhook/don't_capture_output_on_success_by_default@test/hooks.json.tmpl
=== RUN   TestWebhook/capture_output_on_success_with_flag_set@test/hooks.json.tmpl
=== RUN   TestWebhook/don't_capture_output_on_error_by_default@test/hooks.json.tmpl
=== RUN   TestWebhook/capture_output_on_error_with_extra_flag_set@test/hooks.json.tmpl
=== RUN   TestWebhook/static_params_should_pass@test/hooks.json.tmpl
=== RUN   TestWebhook/command_with_space_logs_warning@test/hooks.json.tmpl
=== RUN   TestWebhook/unsupported_content_type_error@test/hooks.json.tmpl
=== RUN   TestWebhook/github@test/hooks.yaml.tmpl
=== RUN   TestWebhook/github-multi-sig@test/hooks.yaml.tmpl
=== RUN   TestWebhook/github-multi-sig-fail@test/hooks.yaml.tmpl
=== RUN   TestWebhook/bitbucket@test/hooks.yaml.tmpl
=== RUN   TestWebhook/gitlab@test/hooks.yaml.tmpl
=== RUN   TestWebhook/xml@test/hooks.yaml.tmpl
=== RUN   TestWebhook/txt-raw@test/hooks.yaml.tmpl
=== RUN   TestWebhook/payload-json-array@test/hooks.yaml.tmpl
=== RUN   TestWebhook/slash-in-hook-id@test/hooks.yaml.tmpl
=== RUN   TestWebhook/multipart@test/hooks.yaml.tmpl
=== RUN   TestWebhook/issue-471@test/hooks.yaml.tmpl
=== RUN   TestWebhook/issue-471-and@test/hooks.yaml.tmpl
=== RUN   TestWebhook/missing-cmd-arg@test/hooks.yaml.tmpl
=== RUN   TestWebhook/missing-env-arg@test/hooks.yaml.tmpl
=== RUN   TestWebhook/empty-payload-signature@test/hooks.yaml.tmpl
=== RUN   TestWebhook/request-source@test/hooks.yaml.tmpl
=== RUN   TestWebhook/global_disallowed_method@test/hooks.yaml.tmpl
=== RUN   TestWebhook/disallowed_method@test/hooks.yaml.tmpl
=== RUN   TestWebhook/empty_payload@test/hooks.yaml.tmpl
=== RUN   TestWebhook/empty_payload@test/hooks.yaml.tmpl#01
=== RUN   TestWebhook/empty_payload@test/hooks.yaml.tmpl#02
=== RUN   TestWebhook/don't_capture_output_on_success_by_default@test/hooks.yaml.tmpl
=== RUN   TestWebhook/capture_output_on_success_with_flag_set@test/hooks.yaml.tmpl
=== RUN   TestWebhook/don't_capture_output_on_error_by_default@test/hooks.yaml.tmpl
=== RUN   TestWebhook/capture_output_on_error_with_extra_flag_set@test/hooks.yaml.tmpl
=== RUN   TestWebhook/static_params_should_pass@test/hooks.yaml.tmpl
=== RUN   TestWebhook/command_with_space_logs_warning@test/hooks.yaml.tmpl
=== RUN   TestWebhook/unsupported_content_type_error@test/hooks.yaml.tmpl
--- PASS: TestWebhook (12.04s)
    --- PASS: TestWebhook/github@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/github-multi-sig@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/github-multi-sig-fail@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/bitbucket@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/gitlab@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/xml@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/txt-raw@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/payload-json-array@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/slash-in-hook-id@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/multipart@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/issue-471@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/issue-471-and@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/missing-cmd-arg@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/missing-env-arg@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/empty-payload-signature@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/request-source@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/global_disallowed_method@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/disallowed_method@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/empty_payload@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/empty_payload@test/hooks.json.tmpl#01 (0.20s)
    --- PASS: TestWebhook/empty_payload@test/hooks.json.tmpl#02 (0.20s)
    --- PASS: TestWebhook/don't_capture_output_on_success_by_default@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/capture_output_on_success_with_flag_set@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/don't_capture_output_on_error_by_default@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/capture_output_on_error_with_extra_flag_set@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/static_params_should_pass@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/command_with_space_logs_warning@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/unsupported_content_type_error@test/hooks.json.tmpl (0.20s)
    --- PASS: TestWebhook/github@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/github-multi-sig@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/github-multi-sig-fail@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/bitbucket@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/gitlab@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/xml@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/txt-raw@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/payload-json-array@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/slash-in-hook-id@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/multipart@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/issue-471@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/issue-471-and@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/missing-cmd-arg@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/missing-env-arg@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/empty-payload-signature@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/request-source@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/global_disallowed_method@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/disallowed_method@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/empty_payload@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/empty_payload@test/hooks.yaml.tmpl#01 (0.20s)
    --- PASS: TestWebhook/empty_payload@test/hooks.yaml.tmpl#02 (0.20s)
    --- PASS: TestWebhook/don't_capture_output_on_success_by_default@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/capture_output_on_success_with_flag_set@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/don't_capture_output_on_error_by_default@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/capture_output_on_error_with_extra_flag_set@test/hooks.yaml.tmpl (0.21s)
    --- PASS: TestWebhook/static_params_should_pass@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/command_with_space_logs_warning@test/hooks.yaml.tmpl (0.20s)
    --- PASS: TestWebhook/unsupported_content_type_error@test/hooks.yaml.tmpl (0.20s)
PASS
ok      github.com/adnanh/webhook       12.047s

This commit allows webhook to setuid/setgid when running on Linux. Tested with: go get -d CGO_ENABLED=0 go build -ldflags="-s -w" Correctly compiled, ran, setuid/setgid properly, and answered hook requests.

SaschaBrechmannVHV · 2024-03-20T07:13:42Z

@adnanh : How about to merge this PR ? Would be nice to have some more Security if running webhook als Linux-Service

adnanh · 2024-03-25T14:32:10Z

@adnanh : How about to merge this PR ? Would be nice to have some more Security if running webhook als Linux-Service

I'll check it out as soon as possible

adnanh · 2024-04-13T17:56:56Z

Hey, thank you for the contribution!

I found a bug in our code while checking this out :)

christopher-conley added 2 commits July 22, 2023 23:01

Allow Linux setuid/setgid

f108a2b

This commit allows webhook to setuid/setgid when running on Linux. Tested with: go get -d CGO_ENABLED=0 go build -ldflags="-s -w" Correctly compiled, ran, setuid/setgid properly, and answered hook requests.

Merge branch 'adnanh:master' into allow_linux_setuid_setgid

3da6122

christopher-conley mentioned this pull request Apr 11, 2024

Update GH actions and dependencies #681

Merged

Merge branch 'master' into allow_linux_setuid_setgid

8af5a38

adnanh merged commit 85f244c into adnanh:master Apr 13, 2024

hhoffstaette mentioned this pull request May 21, 2024

dev-util/webhook: add 2.8.1, various additions/improvements gentoo/gentoo#36436

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Allow Linux setuid/setgid #646

Allow Linux setuid/setgid #646

Uh oh!

christopher-conley commented Jul 23, 2023 •

edited

Loading

Uh oh!

SaschaBrechmannVHV commented Mar 20, 2024

Uh oh!

adnanh commented Mar 25, 2024

Uh oh!

adnanh commented Apr 13, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Allow Linux setuid/setgid #646

Allow Linux setuid/setgid #646

Uh oh!

Conversation

christopher-conley commented Jul 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SaschaBrechmannVHV commented Mar 20, 2024

Uh oh!

adnanh commented Mar 25, 2024

Uh oh!

adnanh commented Apr 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

christopher-conley commented Jul 23, 2023 •

edited

Loading

adnanh commented Apr 13, 2024 •

edited

Loading