openssl-lambda-layer icon indicating copy to clipboard operation
openssl-lambda-layer copied to clipboard

Test fails: permission denied

Open dominusmi opened this issue 3 years ago • 1 comments

I was trying to update the layer so that it would use openssl 1.1.0 instead of 1.0.2, but I realised that the test.sh doesn't seem to work on my machine, it fails with this error:

testCert.key: Permission denied
140694466910112:error:0200100D:system library:fopen:Permission denied:bss_file.c:402:fopen('testCert.key','w')
140694466910112:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:404:
2021-05-01T17:22:50.095Z	7402451d-2322-19a3-5e35-22113df5f63c	ERROR	Invoke Error	{"errorType":"Error","errorMessage":"Command failed:  openssl genrsa -out testCert.key 2048","status":1,"signal":null,"output":[null,null,null],"pid":25,"stdout":null,"stderr":null,"stack":["Error: Command failed:  openssl genrsa -out testCert.key 2048","    at checkExecSyncError (child_process.js:629:11)","    at execSync (child_process.js:666:13)","    at Runtime.exports.handler (/var/task/index.js:4:5)","    at Runtime.handleOnce (/var/runtime/Runtime.js:66:25)"]}

Not sure if I'm doing something wrong, tried googling but I've never used nodejs. Seems like the command needs to be executed as root, but that shouldn't be. I've tried replacing the path with ~/testCert.key to check if it was a directory issue, but that didn't work either.

For the record, I'm running

sh build.sh
sh test.sh

as normal user. When the layer directory is created, I chown as myself (it's docker's initially)

dominusmi avatar May 01 '21 17:05 dominusmi

I've found out it does have to do with the nodejs docker's permission. I guess you have a setup on your local machine which gives it more write access. If for example you change the command from openssl genrsa -out testCert.key 2048 to openssl genrsa -out /tmp/testCert.key 2048 the test works.

In fact I wonder if it needs to write to a file at all, the test could simply not have the -out argument to check if the command works, and to avoid such issues.

dominusmi avatar May 01 '21 17:05 dominusmi