mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
Charlie Egan
d584a15d53
I have added a system for showing fatal and non-fatal deprecation warnings. It's configurable by command and environment. If we merge this PR, running a rootless image with any OPA command other than `opa run` will result in a fatal error and exit code 1. It's possible for users to continue to use the image by unsetting: OPA_DOCKER_IMAGE_TAG=rootless. `opa run` will show the message, but it's not fatal for this command. This is intended to avoid production disruption. Signed-off-by: Charlie Egan <charlie@styra.com>
24 lines
702 B
Go
24 lines
702 B
Go
// Copyright 2022 The OPA Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache2
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package runtime
|
|
|
|
import (
|
|
"os/user"
|
|
|
|
"github.com/open-policy-agent/opa/logging"
|
|
)
|
|
|
|
// checkUserPrivileges on Linux could be running in Docker, so we check if
|
|
// we're running in the official container image.
|
|
func checkUserPrivileges(logger logging.Logger) {
|
|
usr, err := user.Current()
|
|
if err != nil {
|
|
logger.Debug("Failed to determine uid/gid of process owner")
|
|
} else if usr.Uid == "0" || usr.Gid == "0" {
|
|
message := "OPA running with uid or gid 0. Running OPA with root privileges is not recommended."
|
|
logger.Warn(message)
|
|
}
|
|
}
|