Skip to content

fix(orch): keep root-executed helpers unwritable under the world-writable /usr/local #3439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tomassrnka wants to merge 2 commits into from
Closed

fix(orch): keep root-executed helpers unwritable under the world-writable /usr/local #3439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e9db1cb
fix(orch): keep root-executed helpers unwritable under the world-writ…
tomassrnka Jul 29, 2026
42b5793
Merge branch 'main' into fix/usr-local-sticky
tomassrnka Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions packages/orchestrator/pkg/template/build/phases/finalize/configure.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,12 @@ if command -v update-ca-certificates >/dev/null 2>&1; then
fi
mkdir -p /usr/local/share/e2b
tar -C /etc/ssl/certs -chf /usr/local/share/e2b/ssl-certs.tar .
# Root extracts this tar into the boot-time cert tmpfs, so it must not be
# writable by the sandbox user. Set explicitly: the configuration script's
# chmod -R 777 /usr/local ran before this step, and rewriting the tar in place
# on a FROM-template rebuild keeps the existing file's mode and owner.
chown root:root /usr/local/share/e2b/ssl-certs.tar
chmod 644 /usr/local/share/e2b/ssl-certs.tar
`

// packCertBundle runs packCertBundleCmd in the guest as root.
Expand Down
29 changes: 29 additions & 0 deletions packages/orchestrator/pkg/template/build/phases/finalize/configure.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,35 @@ chown -R user:user /home/user
echo "Give 777 permission to /usr/local"
chmod -R 777 /usr/local

# The 777 above is what lets sandbox users install into /usr/local without
# sudo, but it also lets them delete or replace the E2B helpers root runs at
# boot (envd's ExecStartPre). Sticky keeps that convenience — anyone can still
# create files here — while restricting unlink/rename to a file's owner, so the
# root-owned helpers below cannot be swapped out. Defense in depth: 'user'
# already has NOPASSWD sudo, so this is not a privilege boundary.
# The whole ancestor chain needs it, not just the leaves: a sticky directory
# whose parent is world-writable and non-sticky can be renamed aside wholesale
# and recreated with replaced contents.
echo "Set the sticky bit on the directories holding root-executed E2B helpers"
for dir in /usr/local /usr/local/bin /usr/local/share /usr/local/share/e2b; do
if [ -d "$dir" ]; then
chmod 1777 "$dir"
fi
Comment thread
tomassrnka marked this conversation as resolved.
done
echo "Restore root-owned, non-writable modes on the E2B helpers"
for exe in /usr/local/bin/e2b-seed-certs /usr/local/bin/e2b-provision-runner /usr/local/share/e2b/envd.openrc; do
if [ -f "$exe" ]; then
chown root:root "$exe"
chmod 755 "$exe"
fi
done
# distro.env is sourced by root here and by later FROM-template builds.
# ssl-certs.tar is packed after this script runs, so it is hardened there.
if [ -f /usr/local/share/e2b/distro.env ]; then
chown root:root /usr/local/share/e2b/distro.env
chmod 644 /usr/local/share/e2b/distro.env
fi

echo "Create /code directory"
mkdir -p /code
echo "Give 777 permission to /code"
Expand Down
Loading