gh-net icon indicating copy to clipboard operation
gh-net copied to clipboard

Running `gh net` elevated on macOS creates `~/.ssh` owned by root:staff

Open baldwicc opened this issue 2 years ago • 0 comments

Describe the bug

On a fresh macOS 13.4 user profile with no ~/.ssh folder, installing and running gh net appears to create the following files owned by root:staff rather than the logged-in user:

~/.ssh/codespaces.auto
~/.ssh/codespaces.auto.pub

This causes issues for other apps - specifically, attempts to launch local Dev Containers in VS Code. Launching a Codespace in VS Code still works fine.

Fix is to revert the permissions sudo chown -r "${USER}:staff" ~/.ssh

Reproduce steps Steps to reproduce the behavior:

  1. Have no ~/.ssh folder
  2. Install brew
  3. Install vscode and docker (e.g. brew install --cask visual-studio-code docker)
  4. Install gh cli (e.g. brew install gh)
  5. Install gh net extension (e.g.gh extension install github/gh-net)
  6. Launch a Codespace (web or via VS Code)
  7. Launch a local Dev Container in VS Code (any of the sample ones will do)
  8. Run gh net to provide local networking to the running codespace
  9. Rebuild the local Dev Container - fails to launch
  10. sudo ls -alir ~/.ssh to see permissions are set to root:staff

Expected behavior ~/.ssh should not be owned by root

Desktop (please complete the following information):

  • OS: macOS
  • Version: 13.4
  • Platform architecture: arm64

Additional context I'm assuming this is caused by gh net needing elevated access for networking, but GenerateSSHKey in pkg/ssh/ssh_keys.go#L42 then assumes these privs when creating the directory and files.

Raising this issue in github/gh-net rather than cli/cli since the root cause is the elevated privilege - but happy to report it upstream if that's better

baldwicc avatar Jun 28 '23 05:06 baldwicc