RSDK-13159 Switch users if viam-server is run as root on macOS#26
RSDK-13159 Switch users if viam-server is run as root on macOS#26oliviamiller merged 5 commits intoviam-modules:mainfrom
Conversation
oliviamiller
requested review from
SebastianMunozP,
benjirewis,
hexbabe and
seanavery
|
I don't have the full context so I'm not sure if my worry is valid, but this seems a bit invasive and full of side effects to me. We're mutating the ownership of the entire module directory tree, recursively, and running the binary as user silently to ensure success. Wouldn't it be better to just fail-fast and clearly? And tell the user to run as a normal user instead? |
For more context this is being added due to the current netcode project to add viam-agent support for mac, which will run viam-server as root. This was suggested by netcode as a work around to allow this module to work while running viam-agent. |
benjirewis
left a comment
benjirewis
left a comment
There was a problem hiding this comment.
@hexbabe like @oliviamiller mentioned, viam-agent is soon coming to MacOS and it runs non-configurably as root. Sounds like this module needs to run as anyone but root, so this was the type of solution we came up with. Failing immediately here likely isn't an option, because we do want to be able to run this module with viam-agent on MacOS.
Right this is the context I had a feeling I was missing. Thanks |
| # Transfer ownership to console user so they can access files | ||
| chown -R "$CONSOLE_USER" "$SCRIPT_DIR" | ||
| chown "$CONSOLE_USER" "$SCRIPT_DIR/.." | ||
|
|
There was a problem hiding this comment.
[nit] Perhaps add a log here stating that this is being run as $CONSOLE_USER
| @@ -0,0 +1,26 @@ | |||
| #!/bin/bash | |||
| # macOS: root can't access microphone due to TCC restrictions | |||
| # Switch to the console user (whoever is logged in) | |||
There was a problem hiding this comment.
cc @aldenh-viam this is what the sensing team is doing for switching off of the root user on MacOS in case you were curious.
benjirewis
left a comment
benjirewis
left a comment
There was a problem hiding this comment.
Looks reasonable to me as long as you tested by running viam-server as root. Thanks!
5 participants
Microphone access does not work when the module is running as root on macOS due to TCC security restrictions. The run.sh ensures the module runs as the console user (logged in user), allowing access to the microphone.
Tested: