From 746c840a4e5707743aecd55a48799e25a1ff0c40 Mon Sep 17 00:00:00 2001 From: Daniel Linsley Date: Thu, 17 Sep 2026 13:03:35 -0700 Subject: [PATCH] Replace use of chpst for Ubuntu Resolute Raccoon (26.04) Ubuntu 26.04 removes the `runit` package, eliminating `chpst`. Introduce `privdrop_utils.sh` with `run_as_vcap` backed by `setpriv` in `system-metrics-agent` and use it in `ctl.erb`. As per https://github.com/cloudfoundry/community/blob/main/toc/rfc/rfc-0058-resolute-raccoon-os.md#stemcell-change-removal-of-runit --- .../templates/ctl.erb | 4 ++- packages/system-metrics-agent/packaging | 4 +++ packages/system-metrics-agent/spec | 1 + spec/jobs/loggr_system_metrics_agent_spec.rb | 15 ++++++++++ src/scripts/privdrop_utils.sh | 8 +++++ src/scripts/privdrop_utils_test.bats | 30 +++++++++++++++++++ 6 files changed, 61 insertions(+), 1 deletion(-) create mode 100755 src/scripts/privdrop_utils.sh create mode 100644 src/scripts/privdrop_utils_test.bats diff --git a/jobs/loggr-system-metrics-agent/templates/ctl.erb b/jobs/loggr-system-metrics-agent/templates/ctl.erb index 039ecf72..24f233b1 100644 --- a/jobs/loggr-system-metrics-agent/templates/ctl.erb +++ b/jobs/loggr-system-metrics-agent/templates/ctl.erb @@ -16,6 +16,8 @@ mkdir -p $LOG_DIR case $1 in start) + source /var/vcap/packages/system-metrics-agent/scripts/privdrop_utils.sh + set +e killall -15 system-metrics-agent killall -9 system-metrics-agent @@ -40,7 +42,7 @@ case $1 in CA_CERT_PATH="/var/vcap/jobs/loggr-system-metrics-agent/config/certs/system_metrics_agent_ca.crt" \ CERT_PATH="/var/vcap/jobs/loggr-system-metrics-agent/config/certs/system_metrics_agent.crt" \ KEY_PATH="/var/vcap/jobs/loggr-system-metrics-agent/config/certs/system_metrics_agent.key" \ - chpst -u vcap:vcap /var/vcap/packages/system-metrics-agent/system-metrics-agent & + run_as_vcap /var/vcap/packages/system-metrics-agent/system-metrics-agent & echo $! > $PIDFILE diff --git a/packages/system-metrics-agent/packaging b/packages/system-metrics-agent/packaging index cd0a31a7..2d1b08ac 100644 --- a/packages/system-metrics-agent/packaging +++ b/packages/system-metrics-agent/packaging @@ -4,3 +4,7 @@ source /var/vcap/packages/golang-1.27-linux/bosh/compile.env export GOPATH=/var/vcap go build -mod=vendor -o ${BOSH_INSTALL_TARGET}/system-metrics-agent ./cmd/system-metrics-agent + +mkdir -p ${BOSH_INSTALL_TARGET}/scripts +cp scripts/privdrop_utils.sh ${BOSH_INSTALL_TARGET}/scripts/privdrop_utils.sh +chmod +x ${BOSH_INSTALL_TARGET}/scripts/privdrop_utils.sh diff --git a/packages/system-metrics-agent/spec b/packages/system-metrics-agent/spec index 0a8a0511..1b0550ae 100644 --- a/packages/system-metrics-agent/spec +++ b/packages/system-metrics-agent/spec @@ -9,3 +9,4 @@ files: - vendor/**/* - go.mod - go.sum +- scripts/**/* diff --git a/spec/jobs/loggr_system_metrics_agent_spec.rb b/spec/jobs/loggr_system_metrics_agent_spec.rb index 3c91d073..58ab8ee4 100644 --- a/spec/jobs/loggr_system_metrics_agent_spec.rb +++ b/spec/jobs/loggr_system_metrics_agent_spec.rb @@ -64,6 +64,21 @@ def render_system_metrics_monit(properties = {}) describe 'bin/ctl' do let(:template) { job.template('bin/ctl') } + it 'sources privdrop_utils.sh from the system-metrics-agent package' do + rendered = template.render({}) + expect(rendered).to include('source /var/vcap/packages/system-metrics-agent/scripts/privdrop_utils.sh') + end + + it 'runs system-metrics-agent using run_as_vcap' do + rendered = template.render({}) + expect(rendered).to match(/run_as_vcap \/var\/vcap\/packages\/system-metrics-agent\/system-metrics-agent &/) + end + + it 'does not use chpst' do + rendered = template.render({}) + expect(rendered).not_to include('chpst') + end + it 'defaults CLOCK_DRIFT_ENABLED to false' do rendered = template.render({}) expect(rendered).to include('CLOCK_DRIFT_ENABLED=false') diff --git a/src/scripts/privdrop_utils.sh b/src/scripts/privdrop_utils.sh new file mode 100755 index 00000000..41ceca55 --- /dev/null +++ b/src/scripts/privdrop_utils.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash + +# run_as_vcap +# +# Exec-style replacement for `chpst -u vcap:vcap "$@"`. +function run_as_vcap() { + setpriv --reuid=vcap --regid=vcap --clear-groups --no-new-privs -- "$@" +} diff --git a/src/scripts/privdrop_utils_test.bats b/src/scripts/privdrop_utils_test.bats new file mode 100644 index 00000000..6451149e --- /dev/null +++ b/src/scripts/privdrop_utils_test.bats @@ -0,0 +1,30 @@ +#!/usr/bin/env bats + +setup() { + source ./privdrop_utils.sh +} + +@test "run_as_vcap runs the given command as the vcap user" { + run run_as_vcap id -un + [ "$status" -eq 0 ] + [ "$output" = "vcap" ] +} + +@test "run_as_vcap runs the given command as the vcap group" { + run run_as_vcap id -gn + [ "$status" -eq 0 ] + [ "$output" = "vcap" ] +} + +@test "run_as_vcap preserves multiple arguments without re-quoting" { + run run_as_vcap echo one two three + [ "$status" -eq 0 ] + [ "$output" = "one two three" ] +} + +@test "run_as_vcap preserves exported environment variables" { + export PRIVDROP_TEST_VAR="some_value" + run run_as_vcap sh -c 'echo "$PRIVDROP_TEST_VAR"' + [ "$status" -eq 0 ] + [ "$output" = "some_value" ] +}