Fix filesystem permission parity (#22)

Author: joe4dev

cmd/localstack/file_utils.go

@@ -0,0 +1,22 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// Inspired by https://stackoverflow.com/questions/73864379/golang-change-permission-os-chmod-and-os-chowm-recursively
+// but using the more efficient WalkDir API
+func ChmodRecursively(root string, mode os.FileMode) error {
+	return filepath.WalkDir(root,
+		func(path string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			err = os.Chmod(path, mode)
+			if err != nil {
+				return err
+			}
+			return nil
+		})
+}

cmd/localstack/main.go

@@ -132,6 +132,15 @@ func main() {
 		log.Fatal("Failed to download code archives: " + err.Error())
 	}
 
+	// fix permissions of the layers directory for better AWS parity
+	if err := ChmodRecursively("/opt", 0755); err != nil {
+		log.Warnln("Could not change file mode recursively of directory /opt:", err)
+	}
+	// fix permissions of the tmp directory for better AWS parity
+	if err := ChmodRecursively("/tmp", 0700); err != nil {
+		log.Warnln("Could not change file mode recursively of directory /tmp:", err)
+	}
+
 	// parse CLI args
 	bootstrap, handler := getBootstrap(os.Args)
 
@@ -141,11 +150,15 @@ func main() {
 		gid := 990
 		AddUser(lsOpts.User, uid, gid)
 		if err := os.Chown("/tmp", uid, gid); err != nil {
-			log.Warnln("Could not change owner of /tmp:", err)
+			log.Warnln("Could not change owner of directory /tmp:", err)
 		}
 		UserLogger().Debugln("Process running as root user.")
-		DropPrivileges(lsOpts.User)
-		UserLogger().Debugln("Process running as non-root user.")
+		err := DropPrivileges(lsOpts.User)
+		if err != nil {
+			log.Warnln("Could not drop root privileges.", err)
+		} else {
+			UserLogger().Debugln("Process running as non-root user.")
+		}
 	}
 
 	logCollector := NewLogCollector()

cmd/localstack/user.go

@@ -70,12 +70,12 @@ func UserLogger() *log.Entry {
 	}
 	uid := os.Getuid()
 	uidString := strconv.Itoa(uid)
-	user, err := user.LookupId(uidString)
+	userObject, err := user.LookupId(uidString)
 	if err != nil {
 		log.Warnln("Could not look up user by uid:", uid, err)
 	}
 	return log.WithFields(log.Fields{
-		"username": user.Username,
+		"username": userObject.Username,
 		"uid":      uid,
 		"euid":     os.Geteuid(),
 		"gid":      os.Getgid(),