chore(master): run the master as a non-root user (#25) (#27)

cmd/master/main.go

@@ -48,19 +48,29 @@ const pollFirstDelay = time.Minute
 const pollWorkers = 4
 
 // registryCredentialsDir returns the directory the registry client reads
-// credentials from (DOCKER_CONFIG, else ~/.docker) and whether a config.json
-// is in it. Only the path is logged, never the file.
-func registryCredentialsDir() (dir string, found bool) {
+// credentials from (DOCKER_CONFIG, else ~/.docker), whether a config.json is
+// in it, and the error from opening it when it exists but cannot be read (for
+// example because the master runs as another user than the file owner). The
+// file is opened and closed, never read; only the path is logged.
+func registryCredentialsDir() (dir string, found bool, readErr error) {
 	dir = os.Getenv("DOCKER_CONFIG")
 	if dir == "" {
 		home, err := os.UserHomeDir()
 		if err != nil {
-			return "", false
+			return "", false, nil
 		}
 		dir = filepath.Join(home, ".docker")
 	}
-	_, err := os.Stat(filepath.Join(dir, "config.json"))
-	return dir, err == nil
+	path := filepath.Join(dir, "config.json")
+	if _, err := os.Stat(path); err != nil {
+		return dir, false, nil
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return dir, true, err
+	}
+	_ = f.Close()
+	return dir, true, nil
 }
 
 func run() error {
@@ -154,8 +164,12 @@ func run() error {
 		BaseContext: baseContext,
 	}
 
-	credDir, credFound := registryCredentialsDir()
-	logger.Info("registry_credentials", "docker_config", credDir, "config_json_found", credFound)
+	credDir, credFound, credReadErr := registryCredentialsDir()
+	logger.Info("registry_credentials", "docker_config", credDir, "config_json_found", credFound,
+		"config_json_readable", credFound && credReadErr == nil)
+	if credReadErr != nil {
+		logger.Warn("registry_credentials_unreadable", "docker_config", credDir, "error", credReadErr)
+	}
 	pollCtx, stopPolling := context.WithCancel(ctx)
 	defer stopPolling()
 	registryPoller := poller.New(st, jobService, registry.New("package-updater-master/"+version, logger), broker, poller.Config{

cmd/master/main_test.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRegistryCredentialsDir(t *testing.T) {
+	t.Run("missing file", func(t *testing.T) {
+		dir := t.TempDir()
+		t.Setenv("DOCKER_CONFIG", dir)
+		got, found, readErr := registryCredentialsDir()
+		assert.Equal(t, dir, got)
+		assert.False(t, found)
+		assert.NoError(t, readErr)
+	})
+
+	t.Run("readable file", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "config.json"), []byte("{}"), 0o600))
+		t.Setenv("DOCKER_CONFIG", dir)
+		_, found, readErr := registryCredentialsDir()
+		assert.True(t, found)
+		assert.NoError(t, readErr)
+	})
+
+	t.Run("unreadable file", func(t *testing.T) {
+		if os.Geteuid() == 0 {
+			t.Skip("root can read any file")
+		}
+		dir := t.TempDir()
+		require.NoError(t, os.WriteFile(filepath.Join(dir, "config.json"), []byte("{}"), 0o000))
+		t.Setenv("DOCKER_CONFIG", dir)
+		_, found, readErr := registryCredentialsDir()
+		assert.True(t, found)
+		assert.Error(t, readErr)
+	})
+}