nitriding-daemon icon indicating copy to clipboard operation
nitriding-daemon copied to clipboard

User ID change ineffective in enclave

Open NullHypothesis opened this issue 2 years ago • 1 comments

I noticed that the user ID change we implemented in https://github.com/brave-experiments/star-randsrv/pull/33 is ineffective in an enclave. The UID always remains 0. I reached out to our AWS contacts and was told that this is by design: Their minimal container runtime does not support user ID changes.

We could simply document this behavior in the Dockerfiles that contain a USER instruction (e.g., here) but I am tempted to partially undo https://github.com/brave/nitriding/pull/36, https://github.com/brave/nitriding/pull/37 (while keeping the refactored code), and https://github.com/brave-experiments/star-randsrv/pull/33 because these changes introduce a non-trivial amount of complexity that only benefits applications that are run outside an enclave, which I would not consider a critical use case. Do you have thoughts on this, @rillian?

NullHypothesis avatar Oct 12 '22 16:10 NullHypothesis