Skip to content

cmd/initContainer: Simplify code by removing a function parameter #1356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
debarshiray merged 2 commits into from
Aug 22, 2023
Merged

cmd/initContainer: Simplify code by removing a function parameter #1356

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
219f5b4
cmd/initContainer: Be aware of security hardened / or /etc
alatiera Aug 19, 2023
6bd7c87
cmd/initContainer: Simplify code by removing a function parameter
debarshiray Aug 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 25 additions & 39 deletions src/cmd/initContainer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ var (
source string
flags string
}{
{"/etc/machine-id", "/run/host/etc/machine-id", "ro"},
{"/etc/machine-id", "/run/host/etc/machine-id", ""},
{"/run/libvirt", "/run/host/run/libvirt", ""},
{"/run/systemd/journal", "/run/host/run/systemd/journal", ""},
{"/run/systemd/resolve", "/run/host/run/systemd/resolve", ""},
Expand Down Expand Up @@ -236,24 +236,12 @@ func initContainer(cmd *cobra.Command, args []string) error {
}
}

if _, err := user.Lookup(initContainerFlags.user); err != nil {
if err := configureUsers(initContainerFlags.uid,
initContainerFlags.user,
initContainerFlags.home,
initContainerFlags.shell,
initContainerFlags.homeLink,
false); err != nil {
return err
}
} else {
if err := configureUsers(initContainerFlags.uid,
initContainerFlags.user,
initContainerFlags.home,
initContainerFlags.shell,
initContainerFlags.homeLink,
true); err != nil {
return err
}
if err := configureUsers(initContainerFlags.uid,
initContainerFlags.user,
initContainerFlags.home,
initContainerFlags.shell,
initContainerFlags.homeLink); err != nil {
return err
}

if utils.PathExists("/etc/krb5.conf.d") && !utils.PathExists("/etc/krb5.conf.d/kcm_default_ccache") {
Expand Down Expand Up @@ -386,9 +374,7 @@ func initContainerHelp(cmd *cobra.Command, args []string) {
}
}

func configureUsers(targetUserUid int,
targetUser, targetUserHome, targetUserShell string,
homeLink, targetUserExists bool) error {
func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShell string, homeLink bool) error {
if homeLink {
if err := redirectPath("/home", "/var/home", true); err != nil {
return err
Expand All @@ -400,45 +386,45 @@ func configureUsers(targetUserUid int,
return fmt.Errorf("failed to get group for sudo: %w", err)
}

if targetUserExists {
logrus.Debugf("Modifying user %s with UID %d:", targetUser, targetUserUid)
if _, err := user.Lookup(targetUser); err != nil {
logrus.Debugf("Adding user %s with UID %d:", targetUser, targetUserUid)

usermodArgs := []string{
"--append",
useraddArgs := []string{
"--groups", sudoGroup,
"--home", targetUserHome,
"--home-dir", targetUserHome,
"--no-create-home",
"--shell", targetUserShell,
"--uid", fmt.Sprint(targetUserUid),
targetUser,
}

logrus.Debug("usermod")
for _, arg := range usermodArgs {
logrus.Debug("useradd")
for _, arg := range useraddArgs {
logrus.Debugf("%s", arg)
}

if err := shell.Run("usermod", nil, nil, nil, usermodArgs...); err != nil {
return fmt.Errorf("failed to modify user %s with UID %d: %w", targetUser, targetUserUid, err)
if err := shell.Run("useradd", nil, nil, nil, useraddArgs...); err != nil {
return fmt.Errorf("failed to add user %s with UID %d: %w", targetUser, targetUserUid, err)
}
} else {
logrus.Debugf("Adding user %s with UID %d:", targetUser, targetUserUid)
logrus.Debugf("Modifying user %s with UID %d:", targetUser, targetUserUid)

useraddArgs := []string{
usermodArgs := []string{
"--append",
"--groups", sudoGroup,
"--home-dir", targetUserHome,
"--no-create-home",
"--home", targetUserHome,
"--shell", targetUserShell,
"--uid", fmt.Sprint(targetUserUid),
targetUser,
}

logrus.Debug("useradd")
for _, arg := range useraddArgs {
logrus.Debug("usermod")
for _, arg := range usermodArgs {
logrus.Debugf("%s", arg)
}

if err := shell.Run("useradd", nil, nil, nil, useraddArgs...); err != nil {
return fmt.Errorf("failed to add user %s with UID %d: %w", targetUser, targetUserUid, err)
if err := shell.Run("usermod", nil, nil, nil, usermodArgs...); err != nil {
return fmt.Errorf("failed to modify user %s with UID %d: %w", targetUser, targetUserUid, err)
}
}

Expand Down