From 3370d6c007966b9f13d3dd27fc84e76f112505db Mon Sep 17 00:00:00 2001
From: Ayush Ranjan <ayushranjan@google.com>
Date: Wed, 22 Feb 2023 19:40:05 -0800
Subject: [PATCH] Run tools/install_containerd.sh without sudo -H.

This script was being run as root. This script clones containerd and builds it.
On some Ubuntu versions, sudo(1) does not change the home directory. On
oldkernel machines from BuildKite, this script was running with
$HOME=/home/agent. As a result, root was writing and creating files in
/home/agent/.cache/go-build/. Other tests that call `go build` that were
scheduled to run on such VMs would fail due to permission issues because
/home/agent/.cache/go-build/ is owned by root.

Run the tools/install_containerd.sh script sudo -H so that the home directory
is set appropriately and all packages are built and installed with root user's
cache in /root/.cache/.

Also fixed lint errors in tools/install_containerd.sh and got rid of redundant
sudo calls. Added the check that the script must be run as root.

Co-authored-by: Andrei Vagin <avagin@gmail.com>
Acknowledgements: Andrei Vagin discovered this issue.
PiperOrigin-RevId: 511661564
---
 Makefile                    |  2 +-
 tools/install_containerd.sh | 31 ++++++++++++++++++++++---------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/Makefile b/Makefile
index addfd5072..01c321277 100644
--- a/Makefile
+++ b/Makefile
@@ -327,7 +327,7 @@ fsstress-test: load-basic $(RUNTIME_BIN)
 # Specific containerd version tests.
 containerd-test-%: load-basic_alpine load-basic_python load-basic_busybox load-basic_symlink-resolv load-basic_httpd load-basic_ubuntu $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),) # Clear flags.
-	@sudo tools/install_containerd.sh $*
+	@sudo -H tools/install_containerd.sh $*
 ifeq (,$(STAGED_BINARIES))
 	@$(call sudocopy,//shim:containerd-shim-runsc-v1,"$$(dirname $$(which containerd))")
 else
diff --git a/tools/install_containerd.sh b/tools/install_containerd.sh
index 599647e45..b9742eedc 100755
--- a/tools/install_containerd.sh
+++ b/tools/install_containerd.sh
@@ -16,9 +16,21 @@
 
 set -xeo pipefail
 
+# This script should be run with 'sudo -H'. $HOME must be set correctly because
+# we invoke other scripts below that build Go binaries. In some operating
+# systems, sudo(8) does not change $HOME by default. In such cases, root user
+# ends up creating files in ~/.cache/go-build for the non-root user. This can
+# cause future invocations of go build to fail due to permission issues.
+if [[ "$EUID" -ne 0 ]]; then
+  echo "Run this script with sudo -H"
+  exit 1
+fi
+
 declare -r CONTAINERD_VERSION=${1:-1.3.0}
-declare -r CONTAINERD_MAJOR="$(echo ${CONTAINERD_VERSION} | awk -F '.' '{ print $1; }')"
-declare -r CONTAINERD_MINOR="$(echo ${CONTAINERD_VERSION} | awk -F '.' '{ print $2; }')"
+CONTAINERD_MAJOR="$(echo "${CONTAINERD_VERSION}" | awk -F '.' '{ print $1; }')"
+declare -r CONTAINERD_MAJOR
+CONTAINERD_MINOR="$(echo "${CONTAINERD_VERSION}" | awk -F '.' '{ print $2; }')"
+declare -r CONTAINERD_MINOR
 declare -r CRITOOLS_VERSION=${CRITOOLS_VERSION:-1.18.0}
 
 if [[ "${CONTAINERD_MAJOR}" -eq 1 ]] && [[ "${CONTAINERD_MINOR}" -le 4 ]]; then
@@ -39,7 +51,7 @@ install_helper() {
   declare -r TAG="${2}"
 
   # Clone the repository.
-  mkdir -p "${GOPATH}"/src/$(dirname "${PACKAGE}") && \
+  mkdir -p "${GOPATH}"/src/"$(dirname "${PACKAGE}")" && \
      git clone https://"${PACKAGE}" "${GOPATH}"/src/"${PACKAGE}"
 
   # Checkout and build the repository.
@@ -77,14 +89,15 @@ while true; do
 done
 
 # Install containerd & cri-tools.
-declare -rx GOPATH=$(mktemp -d --tmpdir gopathXXXXX)
+GOPATH=$(mktemp -d --tmpdir gopathXXXXX)
+declare -rx GOPATH
 install_helper github.com/containerd/containerd "v${CONTAINERD_VERSION}"
 install_helper github.com/kubernetes-sigs/cri-tools "v${CRITOOLS_VERSION}"
 
 # Configure containerd-shim.
 declare -r shim_config_path=/etc/containerd/runsc/config.toml
-mkdir -p $(dirname ${shim_config_path})
-cat > ${shim_config_path} <<-EOF
+mkdir -p "$(dirname "${shim_config_path}")"
+tee ${shim_config_path} <<-EOF
 log_path = "/tmp/shim-logs/"
 log_level = "debug"
 
@@ -97,7 +110,7 @@ EOF
 
 # Configure CNI.
 (cd "${GOPATH}" && src/github.com/containerd/containerd/script/setup/install-cni)
-cat <<EOF | sudo tee /etc/cni/net.d/10-bridge.conf
+tee /etc/cni/net.d/10-bridge.conf <<EOF
 {
   "cniVersion": "0.3.1",
   "name": "bridge",
@@ -114,7 +127,7 @@ cat <<EOF | sudo tee /etc/cni/net.d/10-bridge.conf
   }
 }
 EOF
-cat <<EOF | sudo tee /etc/cni/net.d/99-loopback.conf
+tee /etc/cni/net.d/99-loopback.conf <<EOF
 {
   "cniVersion": "0.3.1",
   "type": "loopback"
@@ -122,7 +135,7 @@ cat <<EOF | sudo tee /etc/cni/net.d/99-loopback.conf
 EOF
 
 # Configure crictl.
-cat <<EOF | sudo tee /etc/crictl.yaml
+tee /etc/crictl.yaml <<EOF
 runtime-endpoint: unix:///run/containerd/containerd.sock
 EOF