Cannot read libgo_cosmwasm.so for non-root user

[webmaster128]

In the docker image 0cf23ed945ee from https://hub.docker.com/r/cosmwasm/wasmd/tags, I cannot run wasmcli as a different user than root. This is because libgo_cosmwasm.so cannot be loaded:

# ok
$ docker exec wasmd ldd /go/bin/wasmcli 
        linux-vdso.so.1 (0x00007ffda2186000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f41862ee000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f41862cd000)
        libgo_cosmwasm.so => /go/pkg/mod/github.com/confio/[email protected]/api/libgo_cosmwasm.so (0x00007f4185e5a000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f4185c99000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f41862fe000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f4185c94000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f4185c78000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f4185af5000)

# ok
$ docker exec --user="0" wasmd ldd /go/bin/wasmcli
        linux-vdso.so.1 (0x00007ffd83f8a000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f17953b4000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f1795393000)
        libgo_cosmwasm.so => /go/pkg/mod/github.com/confio/[email protected]/api/libgo_cosmwasm.so (0x00007f1794f20000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1794d5f000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f17953c4000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f1794d5a000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f1794d3e000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f1794bbb000)

# lib missing
docker exec --user="$UID" wasmd ldd /go/bin/wasmcli
        linux-vdso.so.1 (0x00007ffe8e3e2000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fe026036000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fe026015000)
        libgo_cosmwasm.so => not found
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fe025e54000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fe026046000)

This is because a different user cannot access /go/pkg/mod/github.com/confio/[email protected]:

$ docker exec --user="$UID" wasmd ls -lA /go/pkg/mod/github.com/confio/[email protected]
ls: cannot open directory '/go/pkg/mod/github.com/confio/[email protected]': Permission denied

$ docker exec --user="$UID" wasmd ls -lA /go/pkg/mod/github.com/confio
total 4
dr-x------ 7 root root 4096 Jan 22 15:02 [email protected]

I wonder where those restrictive permission settings come from.

[ethanfrey]

I think all scripts run this as root without issue currently.

Is this still an issue? Both, is the behavior the same (I think so)? And does this still need to change (I think not)?

[webmaster128]

The issue still exists. Even if no priority, I think it is annoying and unexpected that you can't execute wasmcli (or other binaries) as different users.

I think I found the core of it. The go module system downloads an extracts packages into temporary folders created by ioutil.TempDir, which creates the folders for the current user only. Then makeDirsReadOnly removes the write flags for all users, converting 700 to 500.

A lot of people are discussing for years about the missing write flag, which prevents you from deleting the cache with rm -r and Go 1.14 got a flag to make those directories writeable. But nobody seems to care that this stuff is accessingle to one user only.

Now I wonder if the proper way to do this is to install the library from the root only location /go/pkg/mod/github.com/confio/[email protected]/api/libgo_cosmwasm.so to a common place for libraries.

[ethanfrey]

Now I wonder if the proper way to do this is to install the library from the root only location /go/pkg/mod/github.com/confio/[email protected]/api/libgo_cosmwasm.so to a common place for libraries.

The *.so file needs to be in the proper location where the go binary expects it (try ldd on the go binary). If you move it, the go binary breaks. If we get static binaries, this goes away. Otherwise, yeah, I guess simply changing the permissions on the location would work.

I guess we could add a chmod to the wasmd-demo docker file?