mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-25 06:20:42 +01:00
Chris Lu
ce4c1fe31e
Self-hosted runners do not ship fuse3, so the setuid repair step failed with 'no fusermount3 in PATH' before the FUSE jobs could run. Install the package instead of failing outright.
73 lines
2.8 KiB
YAML
73 lines
2.8 KiB
YAML
name: Fix fusermount3 setuid
|
|
description: >
|
|
Make sure the fusermount3 an unprivileged mount will find can actually mount.
|
|
Some runner images carry a second, source-built fusermount3 in /usr/local/bin
|
|
that shadows the distro one in PATH; it is neither setuid nor root-owned, so
|
|
every mount fails with "mount failed: Operation not permitted". Both the Go
|
|
mount and sw-fuse resolve the helper through PATH.
|
|
Run it after the step that apt-installs fuse3.
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Point PATH at a fusermount3 that can mount
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# setuid only grants root when root owns the file, and exec follows
|
|
# symlinks, so judge the target.
|
|
can_mount() {
|
|
[ -u "$1" ] && [ "$(stat -Lc %u "$1")" = 0 ]
|
|
}
|
|
|
|
bin=$(command -v fusermount3 || true)
|
|
if [ -z "$bin" ]; then
|
|
# Self-hosted runners are not guaranteed to carry fuse3.
|
|
sudo apt-get update
|
|
sudo apt-get install -y fuse3
|
|
bin=$(command -v fusermount3 || true)
|
|
if [ -z "$bin" ]; then
|
|
echo "no fusermount3 in PATH after installing fuse3" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
if can_mount "$bin"; then
|
|
ls -l "$bin"
|
|
exit 0
|
|
fi
|
|
echo "$bin cannot mount unprivileged:"
|
|
ls -l "$bin"
|
|
|
|
# The distro fusermount3 is setuid root and is the one meant to be used.
|
|
# Reach it through a symlink earlier in PATH: exec resolves the link, so
|
|
# the target keeps its setuid bit, and nothing on the image is modified.
|
|
for distro in /usr/bin/fusermount3 /bin/fusermount3; do
|
|
if [ "$distro" != "$bin" ] && can_mount "$distro"; then
|
|
mkdir -p "$RUNNER_TEMP/fuse-bin"
|
|
ln -sf "$distro" "$RUNNER_TEMP/fuse-bin/fusermount3"
|
|
echo "$RUNNER_TEMP/fuse-bin" >> "$GITHUB_PATH"
|
|
echo "using $distro instead"
|
|
ls -l "$distro"
|
|
exit 0
|
|
fi
|
|
done
|
|
|
|
# No usable distro binary, so setting the bit is the only way out - but
|
|
# the target came from PATH: do that only for a root-owned system binary,
|
|
# never for anything else that happens to sit there.
|
|
case "$bin" in
|
|
/bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/usr/local/bin/*|/usr/local/sbin/*) ;;
|
|
*) echo "refusing to setuid $bin: outside the system bin paths" >&2; exit 1 ;;
|
|
esac
|
|
if [ -L "$bin" ] || [ ! -f "$bin" ] || [ ! -x "$bin" ]; then
|
|
echo "refusing to setuid $bin: not a regular executable file" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$(stat -c %u "$bin")" != 0 ] || [ "$(stat -c %g "$bin")" != 0 ]; then
|
|
echo "refusing to setuid $bin: not owned by root:root" >&2
|
|
exit 1
|
|
fi
|
|
sudo chmod u+s "$bin"
|
|
ls -l "$bin"
|