@@ -9,17 +9,16 @@ import (
99 "os"
1010 "os/exec"
1111 "runtime"
12+ "slices"
1213 "strconv"
1314 "strings"
1415 "syscall"
1516
1617 "golang.org/x/sys/unix"
1718 "golang.org/x/xerrors"
19+ "kernel.org/pub/linux/libs/security/libcap/cap"
1820)
1921
20- // unset is set to an invalid value for nice and oom scores.
21- const unset = - 2000
22-
2322// CLI runs the agent-exec command. It should only be called by the cli package.
2423func CLI () error {
2524 // We lock the OS thread here to avoid a race condition where the nice priority
@@ -51,6 +50,14 @@ func CLI() error {
5150 return xerrors .Errorf ("no exec command provided %+v" , os .Args )
5251 }
5352
53+ if * oom == unset {
54+ // If an explicit oom score isn't set, we use the default.
55+ * oom , err = defaultOOMScore ()
56+ if err != nil {
57+ return xerrors .Errorf ("get default oom score: %w" , err )
58+ }
59+ }
60+
5461 if * nice == unset {
5562 // If an explicit nice score isn't set, we use the default.
5663 * nice , err = defaultNiceScore ()
@@ -59,36 +66,62 @@ func CLI() error {
5966 }
6067 }
6168
62- if * oom == unset {
63- // If an explicit oom score isn't set, we use the default.
64- * oom , err = defaultOOMScore ()
65- if err != nil {
66- return xerrors .Errorf ("get default oom score: %w" , err )
67- }
69+ // We drop effective caps prior to setting dumpable so that we limit the
70+ // impact of someone attempting to hijack the process (i.e. with a debugger)
71+ // to take advantage of the capabilities of the agent process. We encourage
72+ // users to set cap_net_admin on the agent binary for improved networking
73+ // performance and doing so results in the process having its SET_DUMPABLE
74+ // attribute disabled (meaning we cannot adjust the oom score).
75+ err = dropEffectiveCaps ()
76+ if err != nil {
77+ printfStdErr ("failed to drop effective caps: %v" , err )
6878 }
6979
70- err = unix .Setpriority (unix .PRIO_PROCESS , 0 , * nice )
80+ // Set dumpable to 1 so that we can adjust the oom score. If the process
81+ // doesn't have capabilities or has an suid/sgid bit set, this is already
82+ // set.
83+ err = unix .Prctl (unix .PR_SET_DUMPABLE , 1 , 0 , 0 , 0 )
7184 if err != nil {
72- // We alert the user instead of failing the command since it can be difficult to debug
73- // for a template admin otherwise. It's quite possible (and easy) to set an
74- // inappriopriate value for niceness.
75- printfStdErr ("failed to adjust niceness to %d for cmd %+v: %v" , * nice , args , err )
85+ printfStdErr ("failed to set dumpable: %v" , err )
7686 }
7787
7888 err = writeOOMScoreAdj (* oom )
7989 if err != nil {
8090 // We alert the user instead of failing the command since it can be difficult to debug
8191 // for a template admin otherwise. It's quite possible (and easy) to set an
8292 // inappriopriate value for oom_score_adj.
83- printfStdErr ("failed to adjust oom score to %d for cmd %+v: %v" , * oom , args , err )
93+ printfStdErr ("failed to adjust oom score to %d for cmd %+v: %v" , * oom , execArgs (os .Args ), err )
94+ }
95+
96+ // Set dumpable back to 0 just to be safe. It's not inherited for execve anyways.
97+ err = unix .Prctl (unix .PR_SET_DUMPABLE , 0 , 0 , 0 , 0 )
98+ if err != nil {
99+ printfStdErr ("failed to unset dumpable: %v" , err )
100+ }
101+
102+ err = unix .Setpriority (unix .PRIO_PROCESS , 0 , * nice )
103+ if err != nil {
104+ // We alert the user instead of failing the command since it can be difficult to debug
105+ // for a template admin otherwise. It's quite possible (and easy) to set an
106+ // inappriopriate value for niceness.
107+ printfStdErr ("failed to adjust niceness to %d for cmd %+v: %v" , * nice , args , err )
84108 }
85109
86110 path , err := exec .LookPath (args [0 ])
87111 if err != nil {
88112 return xerrors .Errorf ("look path: %w" , err )
89113 }
90114
91- return syscall .Exec (path , args , os .Environ ())
115+ // Remove environment variables specific to the agentexec command. This is
116+ // especially important for environments that are attempting to develop Coder in Coder.
117+ env := os .Environ ()
118+ env = slices .DeleteFunc (env , func (e string ) bool {
119+ return strings .HasPrefix (e , EnvProcPrioMgmt ) ||
120+ strings .HasPrefix (e , EnvProcOOMScore ) ||
121+ strings .HasPrefix (e , EnvProcNiceScore )
122+ })
123+
124+ return syscall .Exec (path , args , env )
92125}
93126
94127func defaultNiceScore () (int , error ) {
@@ -154,3 +187,16 @@ func execArgs(args []string) []string {
154187func printfStdErr (format string , a ... any ) {
155188 _ , _ = fmt .Fprintf (os .Stderr , "coder-agent: %s\n " , fmt .Sprintf (format , a ... ))
156189}
190+
191+ func dropEffectiveCaps () error {
192+ proc := cap .GetProc ()
193+ err := proc .ClearFlag (cap .Effective )
194+ if err != nil {
195+ return xerrors .Errorf ("clear effective caps: %w" , err )
196+ }
197+ err = proc .SetProc ()
198+ if err != nil {
199+ return xerrors .Errorf ("set proc: %w" , err )
200+ }
201+ return nil
202+ }
0 commit comments