Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Actor rootfs `/` is mode 0700, so non-root users cannot traverse the root filesystem

Abierto Apto para principiantes
  • ¿Algo no está bien?
#2,035 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@nybidari ya está trabajando en esto.

Desde el 13/10/2026.

  • #2430 de @ericcurtin — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
go, linux
Área
operating-systems

Línea de trabajo

Comienza en internal/imagecache/bundle_linux.go:61-66 e inspecciona cómo se crean rootfs, upper y work antes del montaje overlay en la línea 81. Lee applyDirFixups en internal/imagecache/implicitdirs.go para determinar si se gestiona la raíz combinada. Se considera terminado cuando la raíz de una imagen estándar sigue siendo recorrible por usuarios que no son root y existe una comprobación de regresión para el comportamiento 0700 de la raíz reportado.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

area/gvisor area/node kind/bug

Summary

Inside a gVisor actor, the root directory / is root:root 0700. A workload that drops to a non-root user cannot resolve any path at all, not even /bin/sh, because the first path component is not traversable. Docker and containerd keep the image root's mode (normally 0755). As shipped, any non-root workload fails on Substrate.

Impact

  • Who hits it: every integrator whose workload runs as, or switches to, a non-root user. Agent runtimes and most hardened images do this.
  • What breaks: su, runuser and any exec as a non-root uid fail with Permission denied. The workload cannot start.
  • Cost: each integrator has to add a root-privileged fixup at actor start.
  • Severity: High.
  • Proposed priority: P1. It blocks non-root workloads out of the box. A workaround exists but needs root at startup, which depends on the uid-0 start (see Workload has no user field or no-new-privileges setting…).

Environment

  • Substrate d277088b (v1alpha).
  • GKE 1.36.x.
  • gVisor sandbox class, unprivileged WorkerPool workers.

Steps to reproduce / evidence

  1. Create the actor (verified live). Use an ActorTemplate whose image is a Debian-based image with a non-root user (for example useradd -u 1000 agent). Create an actor from it.
  2. Check the root mode inside the actor, as root (verified live): 
    $ stat -c '%a:%U:%G %n' /
700:root:root /
  3. Switch to the non-root user (verified live): 
    $ su agent -s /bin/sh -c id
su: failed to execute /bin/sh: Permission denied
    /bin/sh is itself 0755. The failure is at the traversal of /.
  4. Show that a 0755 root is sufficient (verified live). After chmod 755 / (as root), su and runuser to the non-root uid both succeed. The same test also chowned the user's home directory; the exec itself (su … -c id) depends only on / being traversable.
  5. Cause (code-read at d277088b):
    • internal/imagecache/bundle_linux.go:61-66 creates <bundle>/rootfs, upper and work with os.MkdirAll(d, 0o700).
    • The overlay is then mounted at rootfs with that upperdir (bundle_linux.go:81).
    • The merged overlay root takes its attributes from the upperdir root.
    • applyDirFixups in internal/imagecache/implicitdirs.go repairs implicit parent directories. It does not appear to cover / itself.

Expected vs actual

  • Expected: the actor's / has the image root's mode (0755 for standard base images), as under Docker, containerd and Kubernetes.
  • Actual: / is 0700 and owned by root. No non-root uid can traverse it.

Workaround

At actor start, while still uid 0, an integrator can:

  1. chmod 755 / if / is more restrictive than that.
  2. Check that the workload user can traverse the rootfs (for example that /bin/sh resolves).
  3. Fail closed if it cannot.

This only works because the workload starts as root.

Additional detail

  • Suggested fix: create the bundle rootfs/upperdir root with 0755, or copy the image root's mode onto it after the overlay is mounted.
  • Related issues (same class, image metadata lost in the actor rootfs):
    • Image-layer file ownership appears as uid 0 inside the actor (image-layer-file-ownership-lost.md).
    • Actor rootfs drops setuid, setgid and sticky bits from image layers (/tmp is 0777) (actor-rootfs-drops-special-mode-bits.md).
Lenguaje dominante
Go
Estrellas
5.9k
Forks
637
Merge medio
2 d 10 h
PR fusionados (30 d)
562

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de agent-substrate/substrate

Todos los issues de agent-substrate/substrate

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.