This is an automated email from the ASF dual-hosted git repository.
rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git
The following commit(s) were added to refs/heads/master by this push:
new 4a4d17bb8 Fix the worker-launcher build with gcc 15 and glibc 2.43
(#9187)
4a4d17bb8 is described below
commit 4a4d17bb86d6564fd0db4d4be0ad27725ce42247
Author: Richard Zowalla <[email protected]>
AuthorDate: Thu Oct 22 21:34:31 2026 +0200
Fix the worker-launcher build with gcc 15 and glibc 2.43 (#9187)
* Fix the worker-launcher build with gcc 15 and glibc 2.43
glibc 2.43 makes strrchr return a const pointer for a const argument in
C23, which -Werror turns into a build failure in oci.c. Also check the
return values of setuid/setgid, replace length-bounded strncpy calls with
memcpy and initialize the overlay descriptor before the first goto, so the
launcher and its test also build cleanly with -O2.
* Clarify the launcher errors and the test cleanup message
Describe the required owner, group and mode when setuid(0) fails, print the
group id as unsigned, and report a failed test directory cleanup as a
warning.
---
.../native/worker-launcher/impl/configuration.c | 4 +--
storm-core/src/native/worker-launcher/impl/main.c | 34 ++++++++++++++++++----
.../src/native/worker-launcher/impl/oci/oci.c | 2 +-
.../src/native/worker-launcher/impl/oci/oci_reap.c | 3 +-
.../native/worker-launcher/impl/worker-launcher.c | 2 +-
.../worker-launcher/test/test-worker-launcher.c | 8 +++--
6 files changed, 40 insertions(+), 13 deletions(-)
diff --git a/storm-core/src/native/worker-launcher/impl/configuration.c
b/storm-core/src/native/worker-launcher/impl/configuration.c
index 0d63f1e4d..f4b6cf357 100644
--- a/storm-core/src/native/worker-launcher/impl/configuration.c
+++ b/storm-core/src/native/worker-launcher/impl/configuration.c
@@ -206,7 +206,7 @@ void read_config(const char* file_name) {
goto cleanup;
}
memset((void*)config.confdetails[config.size]->key, '\0', key_tok_len+1);
- strncpy((char *)config.confdetails[config.size]->key, equaltok,
key_tok_len);
+ memcpy((char *)config.confdetails[config.size]->key, equaltok,
key_tok_len);
equaltok = strtok_r(NULL, "=", &temp_equaltok);
if (equaltok == NULL) {
fprintf(LOGFILE, "configuration tokenization failed \n");
@@ -236,7 +236,7 @@ void read_config(const char* file_name) {
goto cleanup;
}
memset((void *)config.confdetails[config.size]->value, '\0',
val_tok_len+1);
- strncpy((char *)config.confdetails[config.size]->value, equaltok,
val_tok_len);
+ memcpy((char *)config.confdetails[config.size]->value, equaltok,
val_tok_len);
if((config.size + 1) % MAX_SIZE == 0) {
config.confdetails = (struct confentry **) realloc(config.confdetails,
sizeof(struct confentry **) * (MAX_SIZE + config.size));
diff --git a/storm-core/src/native/worker-launcher/impl/main.c
b/storm-core/src/native/worker-launcher/impl/main.c
index 3d57f7e6c..0287da352 100644
--- a/storm-core/src/native/worker-launcher/impl/main.c
+++ b/storm-core/src/native/worker-launcher/impl/main.c
@@ -123,9 +123,21 @@ int main(int argc, char **argv) {
set_launcher_uid(getuid(), group_info->gr_gid);
// if we are running from a setuid executable, make the real uid root
- setuid(0);
+ if (setuid(0) != 0) {
+ fprintf(ERRORFILE, "ERROR: unable to set user to root - %s\n",
strerror(errno));
+ fprintf(ERRORFILE, "The worker-launcher binary must be owned by root,
group-owned by the"
+ " worker-launcher group, with mode 6550 (setuid/setgid)"
+ " (see \"Run worker processes as user who submitted the topology\"
in SECURITY.md).\n");
+ fflush(ERRORFILE);
+ exit(SETUID_OPER_FAILED);
+ }
// set the real and effective group id to the node manager group
- setgid(group_info->gr_gid);
+ if (setgid(group_info->gr_gid) != 0) {
+ fprintf(ERRORFILE, "ERROR: unable to set group to %u - %s\n",
group_info->gr_gid,
+ strerror(errno));
+ fflush(ERRORFILE);
+ exit(SETUID_OPER_FAILED);
+ }
if (check_executor_permissions(executable_file) != 0) {
fprintf(LOGFILE, "worker-launcher config file: %s \n", conf_file);
@@ -321,8 +333,13 @@ int main(int argc, char **argv) {
exit_code = setup_worker_tmp_permissions(working_dir);
if (exit_code == 0) {
//becomes root.
- setuid(0);
- exit_code = run_oci_container(olc, worker_artifacts_dir);
+ if (setuid(0) != 0) {
+ fprintf(ERRORFILE, "ERROR: unable to set user to root - %s\n",
strerror(errno));
+ fflush(ERRORFILE);
+ exit_code = SETUID_OPER_FAILED;
+ } else {
+ exit_code = run_oci_container(olc, worker_artifacts_dir);
+ }
}
}
}
@@ -345,8 +362,13 @@ int main(int argc, char **argv) {
exit_code = INVALID_ARGUMENT_NUMBER;
} else {
//becomes root.
- setuid(0);
- exit_code = cleanup_oci_container_by_id(container_id,
num_reap_layers_keep);
+ if (setuid(0) != 0) {
+ fprintf(ERRORFILE, "ERROR: unable to set user to root - %s\n",
strerror(errno));
+ fflush(ERRORFILE);
+ exit_code = SETUID_OPER_FAILED;
+ } else {
+ exit_code = cleanup_oci_container_by_id(container_id,
num_reap_layers_keep);
+ }
}
}
} else if (strcasecmp("profile-oci-container", command) == 0) {
diff --git a/storm-core/src/native/worker-launcher/impl/oci/oci.c
b/storm-core/src/native/worker-launcher/impl/oci/oci.c
index 8eca5d900..da9459fb0 100644
--- a/storm-core/src/native/worker-launcher/impl/oci/oci.c
+++ b/storm-core/src/native/worker-launcher/impl/oci/oci.c
@@ -708,7 +708,7 @@ static void exec_runc(const char* container_id, const char*
runc_config_path,
}
}
- char* dir_end = strrchr(runc_config_path, '/');
+ const char* dir_end = strrchr(runc_config_path, '/');
if (dir_end == NULL) {
fprintf(ERRORFILE, "ERROR: Error getting bundle path from config path
%s\n",
runc_config_path);
diff --git a/storm-core/src/native/worker-launcher/impl/oci/oci_reap.c
b/storm-core/src/native/worker-launcher/impl/oci/oci_reap.c
index cd4e4f736..a18019d38 100644
--- a/storm-core/src/native/worker-launcher/impl/oci/oci_reap.c
+++ b/storm-core/src/native/worker-launcher/impl/oci/oci_reap.c
@@ -634,6 +634,7 @@ int reap_oci_layer_mounts(int num_preserve) {
int cleanup_oci_container_by_id(const char* container_id, int
num_reap_layers_keep) {
char* run_root = get_value(OCI_RUN_ROOT_CONFIG_KEY);
+ oci_overlay_desc* desc = NULL;
int rc = 0;
if (run_root == NULL) {
run_root = strdup(DEFAULT_OCI_RUN_ROOT);
@@ -643,7 +644,7 @@ int cleanup_oci_container_by_id(const char* container_id,
int num_reap_layers_ke
}
}
- oci_overlay_desc* desc = malloc(sizeof(oci_overlay_desc));
+ desc = malloc(sizeof(oci_overlay_desc));
if (desc == NULL) {
fputs("ERROR: Unable to allocate memory in cleanup_oci_container_by_id -
malloc", ERRORFILE);
goto mem_fail;
diff --git a/storm-core/src/native/worker-launcher/impl/worker-launcher.c
b/storm-core/src/native/worker-launcher/impl/worker-launcher.c
index 336f00880..1e2299df8 100644
--- a/storm-core/src/native/worker-launcher/impl/worker-launcher.c
+++ b/storm-core/src/native/worker-launcher/impl/worker-launcher.c
@@ -936,7 +936,7 @@ char **tokenize_docker_command(const char *input, int
*split_counter) {
char **linesplit = (char **)malloc(sizeof(char *));
char *p = NULL;
*split_counter = 0;
- strncpy(line, input, strlen(input));
+ memcpy(line, input, strlen(input));
p = strtok(line, " ");
while (p != NULL) {
diff --git a/storm-core/src/native/worker-launcher/test/test-worker-launcher.c
b/storm-core/src/native/worker-launcher/test/test-worker-launcher.c
index bb0bfbc02..327ef6604 100644
--- a/storm-core/src/native/worker-launcher/test/test-worker-launcher.c
+++ b/storm-core/src/native/worker-launcher/test/test-worker-launcher.c
@@ -521,7 +521,9 @@ int main(int argc, char **argv) {
int my_username = 0;
// clean up any junk from previous run
- system("chmod -R u=rwx " TEST_ROOT "; rm -fr " TEST_ROOT);
+ if (system("chmod -R u=rwx " TEST_ROOT "; rm -fr " TEST_ROOT) != 0) {
+ printf("WARNING: could not clean up previous test directory\n");
+ }
if (mkdirs(TEST_ROOT "/logs/userlogs", 0755) != 0) {
exit(1);
@@ -580,7 +582,9 @@ int main(int argc, char **argv) {
run_test_in_child("test_signal_container_group",
test_signal_container_group);
run_test_in_child("test_get_values_degenerate", test_get_values_degenerate);
- seteuid(0);
+ if (seteuid(0) != 0) {
+ printf("WARNING: unable to reacquire root - %s\n", strerror(errno));
+ }
run("rm -fr " TEST_ROOT);
printf("\nFinished tests\n");
