Skip to content
This repository has been archived by the owner on Oct 20, 2023. It is now read-only.

Running gh net elevated on macOS creates ~/.ssh owned by root:staff #59

Open
baldwicc opened this issue Jun 28, 2023 · 0 comments
Open
Labels
bug Something isn't working

Comments

@baldwicc
Copy link

baldwicc commented Jun 28, 2023

Describe the bug

On a fresh macOS 13.4 user profile with no ~/.ssh folder, installing and running gh net appears to create the following files owned by root:staff rather than the logged-in user:

~/.ssh/codespaces.auto
~/.ssh/codespaces.auto.pub

This causes issues for other apps - specifically, attempts to launch local Dev Containers in VS Code. Launching a Codespace in VS Code still works fine.

Fix is to revert the permissions sudo chown -r "${USER}:staff" ~/.ssh

Reproduce steps
Steps to reproduce the behavior:

  1. Have no ~/.ssh folder
  2. Install brew
  3. Install vscode and docker (e.g. brew install --cask visual-studio-code docker)
  4. Install gh cli (e.g. brew install gh)
  5. Install gh net extension (e.g.gh extension install github/gh-net)
  6. Launch a Codespace (web or via VS Code)
  7. Launch a local Dev Container in VS Code (any of the sample ones will do)
  8. Run gh net to provide local networking to the running codespace
  9. Rebuild the local Dev Container - fails to launch
  10. sudo ls -alir ~/.ssh to see permissions are set to root:staff

Expected behavior
~/.ssh should not be owned by root

Desktop (please complete the following information):

  • OS: macOS
  • Version: 13.4
  • Platform architecture: arm64

Additional context
I'm assuming this is caused by gh net needing elevated access for networking, but GenerateSSHKey in pkg/ssh/ssh_keys.go#L42 then assumes these privs when creating the directory and files.

Raising this issue in github/gh-net rather than cli/cli since the root cause is the elevated privilege - but happy to report it upstream if that's better

@baldwicc baldwicc added the bug Something isn't working label Jun 28, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant