openclaw/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 9 Packages Projects Releases Wiki Activity

fix(docker): validate HERMES_UID/GID to prevent privilege escalation in stage2-hook (#35340)

Browse Source 
Co-authored-by: sprmn24 <oncuevtv@gmail.com>
This commit is contained in:
Teknium
2026-05-31 18:46:53 -07:00
committed by GitHub
parent dcbf62e26a
commit 758454d1e4
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docker/stage2-hook.sh
View File

@ -32,6 +32,14 @@ INSTALL_DIR="/opt/hermes"
# is a no-op if the dir already exists. (#18482, salvages #18488)
mkdir -p "$HERMES_HOME"
# Numeric UID/GID validation: must be digits only, 1000-65534
validate_uid_gid() {
case "$1" in
''|*[!0-9]*) return 1 ;;
*) [ "$1" -ge 1000 ] && [ "$1" -le 65534 ] ;;
esac
}
# --- UID/GID remap ---
# Accept PUID/PGID as aliases for HERMES_UID/HERMES_GID. NAS users (UGOS,
# Synology, unRAID) expect the LinuxServer.io PUID/PGID convention and
@ -42,11 +50,11 @@ mkdir -p "$HERMES_HOME"
HERMES_UID="${HERMES_UID:-${PUID:-}}"
HERMES_GID="${HERMES_GID:-${PGID:-}}"
if [ -n "${HERMES_UID:-}" ] && [ "$HERMES_UID" != "$(id -u hermes)" ]; then
if [ -n "${HERMES_UID:-}" ] && validate_uid_gid "$HERMES_UID" && [ "$HERMES_UID" != "$(id -u hermes)" ]; then
echo "[stage2] Changing hermes UID to $HERMES_UID"
usermod -u "$HERMES_UID" hermes
fi
if [ -n "${HERMES_GID:-}" ] && [ "$HERMES_GID" != "$(id -g hermes)" ]; then
if [ -n "${HERMES_GID:-}" ] && validate_uid_gid "$HERMES_GID" && [ "$HERMES_GID" != "$(id -g hermes)" ]; then
echo "[stage2] Changing hermes GID to $HERMES_GID"
# -o allows non-unique GID (e.g. macOS GID 20 "staff" may already
# exist as "dialout" in the Debian-based container image).