bai/curriculum-project-hub
1
0
Fork 1
forked from EduCraft/curriculum-project-hub
Code Pull Requests Activity

fix(ci): drop caps after runuser without setgroups

Browse Source
This commit is contained in:
洪佳荣
2026-07-30 12:17:49 +08:00
parent 315e4bd018
commit d4cd1ad74f
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/hub-check.yml
+6 -8
View File
@@ -117,23 +117,21 @@ jobs:
- name: Prove real Claude SDK Bash sandbox boundary - name: Prove real Claude SDK Bash sandbox boundary
run: | run: |
set -euo pipefail set -euo pipefail
# The proof requires uid>0, CapEff=0, NoNewPrivs=1. Gitea act often # The proof requires uid>0, CapEff=0, and NoNewPrivs=1. Gitea act often
# runs the job as root; drop to a dedicated user with emptied caps. # runs as root; switch to cphci then clear caps under no_new_privs.
if ! id cphci >/dev/null 2>&1; then if ! id cphci >/dev/null 2>&1; then
sudo useradd --create-home --shell /bin/bash cphci useradd --create-home --shell /bin/bash cphci
fi fi
sudo install -d -o cphci -g cphci -m 0700 /w/t install -d -o cphci -g cphci -m 0700 /w/t
REPO_ROOT="$(cd .. && pwd)" REPO_ROOT="$(cd .. && pwd)"
NODE_BIN_DIR="$(dirname "$(command -v node)")" NODE_BIN_DIR="$(dirname "$(command -v node)")"
NPX_BIN="$(command -v npx)" NPX_BIN="$(command -v npx)"
# Vitest/node_modules must be readable by cphci. chown -R cphci:cphci "$REPO_ROOT/hub"
sudo chown -R cphci:cphci "$REPO_ROOT/hub" runuser -u cphci -- env \
sudo -u cphci env \
HOME="/home/cphci" \ HOME="/home/cphci" \
PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" \ PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" \
CPH_SANDBOX_TEST_ROOT=/w/t \ CPH_SANDBOX_TEST_ROOT=/w/t \
/usr/bin/setpriv \ /usr/bin/setpriv \
--reuid=cphci --regid=cphci --clear-groups \
--inh-caps=-all --bounding-set=-all --no-new-privs \ --inh-caps=-all --bounding-set=-all --no-new-privs \
bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts" bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"