From 2c166fe286d17afa24d03d1b68154ee20be8fd27 Mon Sep 17 00:00:00 2001
From: Anders Eknert <anders@eknert.com>
Date: Fri, 4 Mar 2022 14:09:07 +0100
Subject: [PATCH] Warn on uid/gid == 0 (#4374)

Signed-off-by: Anders Eknert <anders@eknert.com>

Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com>
---
 Dockerfile         |  5 +++++
 runtime/runtime.go | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 780703543f..b162c1e30a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,11 @@ FROM ${BASE}
 
 LABEL org.opencontainers.image.authors="Torin Sandall <torinsandall@gmail.com>"
 
+# Temporarily allow us to identify whether running from within an offical
+# Docker image, so that we may print a warning when uid or gid == 0 (root)
+# Remove once https://github.com/open-policy-agent/opa/issues/4295 is done
+ENV OPA_DOCKER_IMAGE="official"
+
 # Any non-zero number will do, and unfortunately a named user will not, as k8s
 # pod securityContext runAsNonRoot can't resolve the user ID:
 # https://github.com/kubernetes/kubernetes/issues/40958. Make root (uid 0) when
diff --git a/runtime/runtime.go b/runtime/runtime.go
index 8eba587d58..acaaff6c71 100644
--- a/runtime/runtime.go
+++ b/runtime/runtime.go
@@ -15,6 +15,7 @@ import (
 	mr "math/rand"
 	"os"
 	"os/signal"
+	"os/user"
 	"strings"
 	"sync"
 	"syscall"
@@ -397,6 +398,17 @@ func (rt *Runtime) Serve(ctx context.Context) error {
 		rt.logger.Error("Token authentication enabled without authorization. Authentication will be ineffective. See https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization for more information.")
 	}
 
+	usr, err := user.Current()
+	if err != nil {
+		rt.logger.Debug("Failed to determine uid/gid of process owner")
+	} else if usr.Uid == "0" || usr.Gid == "0" {
+		message := "OPA running with uid or gid 0. Running OPA with root privileges is not recommended."
+		if os.Getenv("OPA_DOCKER_IMAGE") == "official" {
+			message += " Use the -rootless image to avoid running with root privileges. This will be made the default in later OPA releases."
+		}
+		rt.logger.Warn(message)
+	}
+
 	// NOTE(tsandall): at some point, hopefully we can remove this because the
 	// Go runtime will just do the right thing. Until then, try to set
 	// GOMAXPROCS based on the CPU quota applied to the process.