Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: fail if the user is root #749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 1, 2022
Merged

fix: fail if the user is root #749

merged 1 commit into from
Aug 1, 2022

Conversation

f0rmiga
Copy link
Member

@f0rmiga f0rmiga commented Jul 12, 2022

We have seen folks excluding the .pyc files due to cache misses. See:

This PR adds a check under Linux and macOS that fails if running as root. For those who want to still ignore it, I added a new attribute.

@f0rmiga f0rmiga requested review from brandjon and lberki as code owners July 12, 2022 20:06
@f0rmiga f0rmiga mentioned this pull request Jul 12, 2022
12 tasks
@f0rmiga f0rmiga requested review from hrfuller and removed request for brandjon and lberki July 12, 2022 20:25
if uid == 0:
fail("The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.")
else:
fail("The current user has CAP_DAC_OVERRIDE set, please drop this capability when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps a comment with https://man7.org/linux/man-pages/man7/capabilities.7.html for developers would be helpful.

Also, add a new attribute for the brave to ignore the check.

Signed-off-by: Thulio Ferraz Assis <[email protected]>
@groodt groodt force-pushed the f0rmiga/check-root-user branch from 672303f to 545fea5 Compare August 1, 2022 11:06
@groodt groodt merged commit e67e7dd into main Aug 1, 2022
@groodt groodt deleted the f0rmiga/check-root-user branch August 1, 2022 11:13
Wyverald added a commit that referenced this pull request Feb 28, 2025
Currently, by default, rules_python immediately fails when Bazel is run as root. The reasoning behind this involves .pyc files being generated for hermetic toolchains when they're first used, causing cache misses; to work around this, rules_python opts to make the toolchain installation directory read-only, but running Bazel as root would circumvent this. So rules_python actively detects if the current user is root, and hard fails. This check can be disabled by the root module by setting `python.override(ignore_root_user_error=True)`. (See more context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as rules_python is essentially a dependency of every single Bazel project through protobuf. Effectively, any Bazel project wishing to run as root need to add the override tag above, even if they don't have anything to do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to True instead. Besides, it now unconditionally tries to make the toolchain installation directory read-only, and only outputs a warning if it's detected that the current user is root.

See previous discussions at #713, #749, #907, #1008, #1169, etc.

Fixes #1169.
Wyverald added a commit that referenced this pull request Feb 28, 2025
Currently, by default, rules_python immediately fails when Bazel is run as root. The reasoning behind this involves .pyc files being generated for hermetic toolchains when they're first used, causing cache misses; to work around this, rules_python opts to make the toolchain installation directory read-only, but running Bazel as root would circumvent this. So rules_python actively detects if the current user is root, and hard fails. This check can be disabled by the root module by setting `python.override(ignore_root_user_error=True)`. (See more context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as rules_python is essentially a dependency of every single Bazel project through protobuf. Effectively, any Bazel project wishing to run as root need to add the override tag above, even if they don't have anything to do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to True instead. Besides, it now unconditionally tries to make the toolchain installation directory read-only, and only outputs a warning if it's detected that the current user is root.

See previous discussions at #713, #749, #907, #1008, #1169, etc.

Fixes #1169.
Wyverald added a commit that referenced this pull request Feb 28, 2025
Currently, by default, rules_python immediately fails when Bazel is run as root. The reasoning behind this involves .pyc files being generated for hermetic toolchains when they're first used, causing cache misses; to work around this, rules_python opts to make the toolchain installation directory read-only, but running Bazel as root would circumvent this. So rules_python actively detects if the current user is root, and hard fails. This check can be disabled by the root module by setting `python.override(ignore_root_user_error=True)`. (See more context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as rules_python is essentially a dependency of every single Bazel project through protobuf. Effectively, any Bazel project wishing to run as root need to add the override tag above, even if they don't have anything to do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to True instead. Besides, it now unconditionally tries to make the toolchain installation directory read-only, and only outputs a warning if it's detected that the current user is root.

See previous discussions at #713, #749, #907, #1008, #1169, etc.

Fixes #1169.
Wyverald added a commit that referenced this pull request Feb 28, 2025
Currently, by default, rules_python immediately fails when Bazel is run as root. The reasoning behind this involves .pyc files being generated for hermetic toolchains when they're first used, causing cache misses; to work around this, rules_python opts to make the toolchain installation directory read-only, but running Bazel as root would circumvent this. So rules_python actively detects if the current user is root, and hard fails. This check can be disabled by the root module by setting `python.override(ignore_root_user_error=True)`. (See more context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as rules_python is essentially a dependency of every single Bazel project through protobuf. Effectively, any Bazel project wishing to run as root need to add the override tag above, even if they don't have anything to do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to True instead. Besides, it now unconditionally tries to make the toolchain installation directory read-only, and only outputs a warning if it's detected that the current user is root.

See previous discussions at #713, #749, #907, #1008, #1169, etc.

Fixes #1169.
Wyverald added a commit that referenced this pull request Feb 28, 2025
Currently, by default, rules_python immediately fails when Bazel is run as root. The reasoning behind this involves .pyc files being generated for hermetic toolchains when they're first used, causing cache misses; to work around this, rules_python opts to make the toolchain installation directory read-only, but running Bazel as root would circumvent this. So rules_python actively detects if the current user is root, and hard fails. This check can be disabled by the root module by setting `python.override(ignore_root_user_error=True)`. (See more context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as rules_python is essentially a dependency of every single Bazel project through protobuf. Effectively, any Bazel project wishing to run as root need to add the override tag above, even if they don't have anything to do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to True instead. Besides, it now unconditionally tries to make the toolchain installation directory read-only, and only outputs a warning if it's detected that the current user is root.

See previous discussions at #713, #749, #907, #1008, #1169, etc.

Fixes #1169.
github-merge-queue bot pushed a commit that referenced this pull request Mar 3, 2025
Currently, by default, rules_python immediately fails when Bazel is run
as root. The reasoning behind this involves .pyc files being generated
for hermetic toolchains when they're first used, causing cache misses;
to work around this, rules_python opts to make the toolchain
installation directory read-only, but running Bazel as root would
circumvent this. So rules_python actively detects if the current user is
root, and hard fails. This check can be disabled by the root module by
setting `python.override(ignore_root_user_error=True)`. (See more
context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as
rules_python is essentially a dependency of every single Bazel project
through protobuf. Effectively, any Bazel project wishing to run as root
need to add the override tag above, even if they don't have anything to
do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to
True instead. Besides, it now unconditionally tries to make the
toolchain installation directory read-only, and only outputs a warning
if it's detected that the current user is root.

See previous discussions at #713, #749, #907, #1008, #1169, etc.

Fixes #1169.

---------

Co-authored-by: Richard Levasseur <[email protected]>
dcode pushed a commit to dcode/rules_python that referenced this pull request Mar 3, 2025
…-contrib#2636)

Currently, by default, rules_python immediately fails when Bazel is run
as root. The reasoning behind this involves .pyc files being generated
for hermetic toolchains when they're first used, causing cache misses;
to work around this, rules_python opts to make the toolchain
installation directory read-only, but running Bazel as root would
circumvent this. So rules_python actively detects if the current user is
root, and hard fails. This check can be disabled by the root module by
setting `python.override(ignore_root_user_error=True)`. (See more
context in the linked issues/PRs.)

This causes a reverberating effect across the Bazel ecosystem, as
rules_python is essentially a dependency of every single Bazel project
through protobuf. Effectively, any Bazel project wishing to run as root
need to add the override tag above, even if they don't have anything to
do with Python at all.

This PR changes the default value of the `ignore_root_user_error` to
True instead. Besides, it now unconditionally tries to make the
toolchain installation directory read-only, and only outputs a warning
if it's detected that the current user is root.

See previous discussions at bazel-contrib#713, bazel-contrib#749, bazel-contrib#907, bazel-contrib#1008, bazel-contrib#1169, etc.

Fixes bazel-contrib#1169.

---------

Co-authored-by: Richard Levasseur <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants