bai/curriculum-project-hub
1
0
Fork 1
forked from EduCraft/curriculum-project-hub
Code Pull Requests Activity

fix(ci): clear caps as root when switching sandbox uid

Browse Source
This commit is contained in:
洪佳荣
2026-07-30 12:24:12 +08:00
parent d4cd1ad74f
commit fdd83999df
1 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/hub-check.yml
+9 -10
View File
@@ -117,8 +117,8 @@ jobs:
- name: Prove real Claude SDK Bash sandbox boundary - name: Prove real Claude SDK Bash sandbox boundary
run: | run: |
set -euo pipefail set -euo pipefail
# The proof requires uid>0, CapEff=0, and NoNewPrivs=1. Gitea act often # The proof requires uid>0, CapEff=0, and NoNewPrivs=1. Switch uid and
# runs as root; switch to cphci then clear caps under no_new_privs. # clear capability sets in one setpriv call (as root).
if ! id cphci >/dev/null 2>&1; then if ! id cphci >/dev/null 2>&1; then
useradd --create-home --shell /bin/bash cphci useradd --create-home --shell /bin/bash cphci
fi fi
@@ -126,14 +126,13 @@ jobs:
REPO_ROOT="$(cd .. && pwd)" REPO_ROOT="$(cd .. && pwd)"
NODE_BIN_DIR="$(dirname "$(command -v node)")" NODE_BIN_DIR="$(dirname "$(command -v node)")"
NPX_BIN="$(command -v npx)" NPX_BIN="$(command -v npx)"
chown -R cphci:cphci "$REPO_ROOT/hub" chown -R cphci:cphci "$REPO_ROOT/hub" /home/cphci
runuser -u cphci -- env \ /usr/bin/setpriv \
HOME="/home/cphci" \ --reuid=cphci --regid=cphci --init-groups \
PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" \ --inh-caps=-all --bounding-set=-all --ambient-caps=-all \
CPH_SANDBOX_TEST_ROOT=/w/t \ --no-new-privs \
/usr/bin/setpriv \ env HOME=/home/cphci PATH="$NODE_BIN_DIR:/usr/local/bin:/usr/bin:/bin" CPH_SANDBOX_TEST_ROOT=/w/t \
--inh-caps=-all --bounding-set=-all --no-new-privs \ bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"
bash -lc "cd '$REPO_ROOT/hub' && '$NPX_BIN' vitest run test/integration/agent-sandbox-linux.test.ts"
- name: Run unit tests - name: Run unit tests
run: npx vitest run test/unit run: npx vitest run test/unit