/tmp/buildkite-agent-hook-wrapper permission problems

[flokli]

Is your feature request related to a problem? Please describe.
I bumped buildkite-agent from 3.59.0 to 3.76.1, and suddenly jobs started failing with the following error message:

🚨 Error: Error creating hook script: failed to create temporary file "hook-before-env": open /tmp/buildkite-agent-hook-wrapper/hook-before-env678448514: permission denied
^^^ +++
🚨 Error: Error setting up job executor: failed to create temporary file "hook-before-env": open /tmp/buildkite-agent-hook-wrapper/hook-before-env678448514: permission denied
^^^ +++

Upon further inspection, the issue is due to /tmp/buildkite-agent-hook-wrapper being owned by the wrong user.

We have multiple buildkite-agent instances running on this host, each as its own linux user. So the first one started up and ceated /tmp/buildkite-agent-hook-wrapper as its user, and then the next step run by another agent fails to write its hook in there.

Looking in the history a bit, this might have been a regression introduced by a798bab, essentially not using a unique tempdir for each invocation anymore.

Describe the solution you'd like
Use os.MkdirTemp to create a temporary dir, and drop the hooks in there, which shouldn't conflict with each other.

Describe alternatives you've considered
For now, we resorted to giving each buildkite-agent systemd service its own private /tmp, by setting PrivateTmp=yes in the systemd unit, though this might not work for everyone.

[DrJosh9000]

This is a great report! Thanks for taking the time to dig into the problem.