-
Notifications
You must be signed in to change notification settings - Fork 69
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[RFC 0076] Require CNB_{USER,GROUP}_SID
instead of CNB_{USER,GROUP}_ID
on windows stack images
#129
Comments
After some digging, it appears there are no straight forward, cross-platform tools for converting SDDL to the binary format used as the The golang implementation calls the Windows API syscall to do convert it: source Wine has an implementation but that would be a heavy-weight dependency and non-trivial to port to golang: source I feel like our best bet may be to require to the format of Which in the image config, would look like: "config":{
"Env":[
"CNB_SECURITY_DESCRIPTOR= AQAAgBQAAAAkAAAAAAAAAAAAAAABAgAAAAAABSAAAAAgAgAAAQIAAAAAAAUgAAAAIAIAAA=="
]
} Which would be generated with: # for owner: BUILTIN/Administrators group: BUILTIN/Administrators
$sddlValue="O:BAG:BA"
$sddl = (ConvertFrom-SddlString $sddlValue)
$sddlBytes = [byte[]]::New($sddl.RawDescriptor.BinaryLength)
$sddl.RawDescriptor.GetBinaryForm($sddlBytes, 0)
[Convert]::ToBase64String($sddlBytes)
# => AQAAgBQAAAAkAAAAAAAAAAAAAAABAgAAAAAABSAAAAAgAgAAAQIAAAAAAAUgAAAAIAIAAA== |
@micahyoung Do we need a cross-platform solution for this? We will only need to convert the string to the binary format on windows right, and therefore we can use the golang implementation? |
If I recall, I thought If this was only needed for lifecycle, we'd be fine with Windows-only though. Update: here's the spot I was thinking of: https://github.com/buildpacks/pack/blob/96d1cdf9e98b4e9adfdb020c0bb253573a3917a5/internal/builder/builder.go#L541 |
@micahyoung good point, I was only thinking about the lifecycle/spec use case. I forgot that the platform reads and uses these env vars. |
The binary format is documented and we could potentially invest the time in implement a golang encoder. It would likely have to move out the timeline on this issue however. There's a couple other C implementations I want to check out as well, though neither seems to have existing golang wrappers ... |
@micahyoung Given that this isn't perfectly straight forward, it is probably worth doing a proof-of-concept before committing to a strategy in the spec. I am going to reschedule this from platform API 0.5 to 0.6 to give us more time to explore options. |
Good call. I feel user-friendly SDDL format ( |
CNB_SECURITY_DESCRIPTOR
instead of CNB_{USER,GROUP}_ID
on windows stack imagesCNB_{USER,GROUP}_SID
instead of CNB_{USER,GROUP}_ID
on windows stack images
RFC 0076
buildpacks/rfcs#133
-uid
and-gid
flags with-usid
and-gsid
flags for builds in windows environmentsMotivating context: buildpacks/lifecycle#343
02/17/2021 - Updated to reflect the result of the RFC above
The text was updated successfully, but these errors were encountered: