Skip to content

Commit

Permalink
Add protection to disable Gitea when run as root (#17168)
Browse files Browse the repository at this point in the history 
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: 6543 <6543@obermui.de>
  • Loading branch information
@techknowlogick @delvh @6543
3 people authored Oct 7, 2021
1 parent 4afdb1e commit f0bd1e9
Show file tree
Hide file tree
Showing 2 changed files with 33 additions and 3 deletions.
24 changes: 21 additions & 3 deletions .drone.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -207,8 +207,14 @@ steps:
commands:
- git update-ref refs/heads/tag_test ${DRONE_COMMIT_SHA}

- name: fix-permissions
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
commands:
- chown -R gitea:gitea .

- name: unit-test
image: golang:1.17
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- make unit-test-coverage test-check
environment:
Expand All @@ -220,7 +226,8 @@ steps:

- name: unit-test-gogit
pull: always
image: golang:1.17
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- make unit-test-coverage test-check
environment:
Expand All @@ -232,6 +239,7 @@ steps:

- name: test-mysql
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- make test-mysql-migration integration-test-coverage
environment:
Expand All @@ -246,6 +254,7 @@ steps:

- name: test-mysql8
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- timeout -s ABRT 40m make test-mysql8-migration test-mysql8
environment:
Expand All @@ -259,6 +268,7 @@ steps:

- name: test-mssql
image: gitea/test_env:linux-amd64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- make test-mssql-migration test-mssql
environment:
Expand Down Expand Up @@ -343,9 +353,15 @@ steps:
exclude:
- pull_request

- name: fix-permissions
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
commands:
- chown -R gitea:gitea .

- name: build
pull: always
image: golang:1.17
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- make backend
environment:
Expand All @@ -355,6 +371,7 @@ steps:

- name: test-sqlite
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- timeout -s ABRT 40m make test-sqlite-migration test-sqlite
environment:
Expand All @@ -368,6 +385,7 @@ steps:

- name: test-pgsql
image: gitea/test_env:linux-arm64 # https://gitea.com/gitea/test-env
user: gitea
commands:
- timeout -s ABRT 40m make test-pgsql-migration test-pgsql
environment:
Expand Down
12 changes: 12 additions & 0 deletions modules/setting/setting.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -902,6 +902,9 @@ func NewContext() {
}

RunUser = Cfg.Section("").Key("RUN_USER").MustString(user.CurrentUsername())
// The following is a purposefully undocumented option. Please do not run Gitea as root. It will only cause future headaches.
// Please don't use root as a bandaid to "fix" something that is broken, instead the broken thing should instead be fixed properly.
unsafeAllowRunAsRoot := Cfg.Section("").Key("I_AM_BEING_UNSAFE_RUNNING_AS_ROOT").MustBool(false)
RunMode = Cfg.Section("").Key("RUN_MODE").MustString("prod")
// Does not check run user when the install lock is off.
if InstallLock {
Expand All @@ -911,6 +914,15 @@ func NewContext() {
}
}

// check if we run as root
if os.Getuid() == 0 {
if !unsafeAllowRunAsRoot {
// Special thanks to VLC which inspired the wording of this messaging.
log.Fatal("Gitea is not supposed to be run as root. Sorry. If you need to use privileged TCP ports please instead use setcap and the `cap_net_bind_service` permission")
}
log.Critical("You are running Gitea using the root user, and have purposely chosen to skip built-in protections around this. You have been warned against this.")
}

SSH.BuiltinServerUser = Cfg.Section("server").Key("BUILTIN_SSH_SERVER_USER").MustString(RunUser)

newRepository()
Expand Down

4 comments on commit f0bd1e9

@OdinVex
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So this is why Gitea is broken for Qnaps. sigh, Gogs it is, then

@jolheiser
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As noted, there is an undocumented option to bypass this.
That being said, I would rather encourage you to run it as intended. 🙂

@OdinVex
Copy link

@OdinVex OdinVex commented on f0bd1e9 Feb 20, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As noted, there is an undocumented option to bypass this. That being said, I would rather encourage you to run it as intended. slightly_smiling_face

Well no, it is assuming uid 0 is root, but other accounts can have uid 0. That's where the trouble was. Took a while to track this down. And no, I don't need anyone getting in the way of my way of doing things. The past few years, everyone seems to be trying to stop people from doing things, slows everything down, prevents fixing things or running things securely. There is no way to start Gitea with no conf to specify that I need to run it with a uid of 0, reliably. A command-line option to bypass during initial conf creation would be nice. Then again, I'm just using Gogs. I don't like a lot of the UI of Gogs, but it works. I'm just going to end up with a portable SBC with a 10GbE+ custom NAS anyway. Gogs will suffice for testing performance, I guess. I've also just realized Gitea doesn't integrate with pre-existing Apache installations as easily, same for SSHd, so I'm going to have to just trash the installation and roll a home-made solution. Oh and, nothing against Gitea, just need it my way.

@zeripath
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Set I_AM_BEING_UNSAFE_RUNNING_AS_ROOT=true to the initial section of the app.ini.

Please sign in to comment.