sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-27 14:59:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

[client] Drop SSH privileges through libc in PKCS#11 package builds (#8323)

Browse Source
This commit is contained in:
Viktor Liu
2026-10-24 10:49:51 +02:00
committed by GitHub
parent c051ca8f87
commit 9dd51ca42e
6 changed files with 260 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/golang-test-linux.yml
+8
View File
@@ -244,6 +244,14 @@ jobs:
NB_TEST_PKCS11_DISPOSABLE: "1"
run: CGO_ENABLED=0 go test -tags pkcs11 -timeout 5m ./client/internal/pkcs11/... ./client/internal/certproof/...
- name: Test SSH privilege drop
# purego marks the runtime as cgo without libc's setxid hooks, so the syscall
# package's setuid family panics in this build. Drop privileges as root to cover it.
run: |
CGO_ENABLED=0 go test -c -tags 'pkcs11 privileged' -o "$RUNNER_TEMP/ssh-server.test" ./client/ssh/server/
sudo "$RUNNER_TEMP/ssh-server.test" -test.run '^TestDropPrivilegesAllThreads$' -test.v
CGO_ENABLED=0 GOARCH=arm64 go test -c -tags 'pkcs11 privileged' -o "$RUNNER_TEMP/ssh-server-arm64.test" ./client/ssh/server/
test_client_on_docker:
name: "Client (Docker) / Unit"
needs: [build-cache]