From bcf6cd8e1a8a7c37a81b25931f9cb5094dcbe8ef Mon Sep 17 00:00:00 2001 From: DevTekVE Date: Sat, 11 Nov 2023 08:31:51 +0100 Subject: [PATCH] Add sudo permissions to gitlab-runner This update adds sudo permissions to the gitlab-runner user group. The .gitlab-ci.yml file has been altered to change user ownership of ${OUTPUT_DIR} in the after_script phase. In install_gitlab_runner.sh, we also add gitlab-runner to the sudo group and explicitly grant it NOPASSWD: ALL rights in the sudoers file. --- .gitlab-ci.yml | 2 ++ release/ci/install_gitlab_runner.sh | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a93556b1ea..4a6b6436fc 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -100,6 +100,8 @@ build: - touch ${BUILD_DIR}/prebuilt - mkdir -p ${OUTPUT_DIR} - shopt -s dotglob && mv ${BUILD_DIR}/* ${OUTPUT_DIR} + after_script: + - sudo chown -R comma:comma ${OUTPUT_DIR} artifacts: paths: - ${OUTPUT_DIR}/ diff --git a/release/ci/install_gitlab_runner.sh b/release/ci/install_gitlab_runner.sh index c8bac10c39..840537fe61 100755 --- a/release/ci/install_gitlab_runner.sh +++ b/release/ci/install_gitlab_runner.sh @@ -15,7 +15,7 @@ OPENPILOT_DIR="$BASE_DIR/openpilot" LOGS_DIR="$BASE_DIR/logs" CACHE_DIR="$BASE_DIR/cache" GITLAB_RUNNER_USERNAME="gitlab-runner" -GROUPS_NEEDED="comma,gpu,gpio" +GROUPS_NEEDED="comma,gpu,gpio,sudo" # Create necessary directories sudo mkdir -p "$BIN_DIR" "$BUILDS_DIR" "$LOGS_DIR" "$CACHE_DIR" "$OPENPILOT_DIR" @@ -28,6 +28,7 @@ sudo chmod +x "$BIN_DIR/gitlab-runner" # Create a GitLab Runner user sudo useradd --comment 'GitLab Runner' --create-home --home-dir ${BASE_DIR} ${GITLAB_RUNNER_USERNAME} --shell /bin/bash -G ${GROUPS_NEEDED} || sudo usermod -aG ${GROUPS_NEEDED} gitlab-runner +grep -qxF 'gitlab-runner ALL=(ALL) NOPASSWD: ALL' /etc/sudoers || echo 'gitlab-runner ALL=(ALL) NOPASSWD: ALL' | sudo tee -a /etc/sudoers #Giving us SUDO rights # Clean bash_logout as it break gitlab pipelines sudo truncate -s 0 ${BASE_DIR}/.bash_logout