GO-2025-3762: New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd

permissions

package

v0.4.1 Latest Latest Go to latest Published: Jan 30, 2025 License: GPL-3.0 Imports: 14 Imported by: 0

Details

Package permissions handles peer user detection and permissions.

This section is empty.

This section is empty.

func WithUnixPeerCreds() grpc.ServerOption

WithUnixPeerCreds returns the credentials of the caller.

func Z_ForTests_DefaultCurrentUserAsRoot()

Z_ForTests_DefaultCurrentUserAsRoot mocks the current user as root for the permission manager.

nolint:revive,nolintlint // We want to use underscores in the function name here.

func Z_ForTests_IdempotentPermissionError(msg string) string

Z_ForTests_IdempotentPermissionError strips the UID from the permission error message.

nolint:revive,nolintlint // We want to use underscores in the function name here.

func Z_ForTests_SetCurrentUserAsRoot(m *Manager, currentUserAsRoot bool)

Z_ForTests_SetCurrentUserAsRoot mutates a default permission to the current user's UID if currentUserAsRoot is true.

nolint:revive,nolintlint // We want to use underscores in the function name here.

type Manager struct {
	// contains filtered or unexported fields
}

Manager is an abstraction of permission process.

func New(args ...Option) Manager

New returns a new Manager.

func (m Manager) IsRequestFromRoot(ctx context.Context) (err error)

IsRequestFromRoot returns nil if the request was performed by a root user. The pid and uid are extracted from peerCredsInfo in the gRPC context.

type Option func(*options)

Option represents an optional function to override Manager default values.

func Z_ForTests_WithCurrentUserAsRoot() Option

Z_ForTests_WithCurrentUserAsRoot returns an Option that sets the rootUID to the current user's UID.

nolint:revive,nolintlint // We want to use underscores in the function name here.