tianon / gosu

Simple Go-based setuid+setgid+setgroups+exec
Apache License 2.0
4.68k stars 312 forks source link

gosu failed switching to "postgres" if it is already switched to postgres #132

Closed EugenKon closed 10 months ago

EugenKon commented 11 months ago

I am about to convert our old scripts to newer version of PG: 11 -> 15. The newer version of PostgreSQL docker image already installs GOSU on its own https://github.com/docker-library/postgres/blob/8a631b939a0b4197cb6bef49b50b6c40c80ddf5b/15/bookworm/Dockerfile#L26 (in our image v11 we install it ourself).

After switching to this new version we got this error message:

++ whoami
postgres
+ gosu postgres sed -i /dbdata/postgres/postgresql.conf -e s/timezone = .*$/timezone = 'UTC'/
error: failed switching to "postgres": operation not permitted

I have checked and found that docker-entrypoint.sh already switched to "postgres": https://github.com/docker-library/postgres/blob/8a631b939a0b4197cb6bef49b50b6c40c80ddf5b/15/bookworm/docker-entrypoint.sh#L308

Yeah, a bit weird, but logically this is a safe operation to switch from "postgres" to "postgres".

Possible solution: Do noop when user tries to switch to same user.

tianon commented 11 months ago

This is exactly why the line you've linked checks that we're root before trying the operation. 😅

For me to be comfortable making this a noop in gosu itself, we'd have to check all the things that gosu sets/changes, but in addition, gosu only really works as root anyways and the check for root is trivial to implement externally, so I'd rather not maintain the more complex code (given the minimal benefit). 🙈