I have the following problem on my CentOS VM.
In the VM I run the process gitlab-runner as root - see my systemd service.
root@runner1:~$ cat /etc/systemd/system/gitlab-runner.service | sed 's/^/ /' [Unit] Description=GitLab Runner After=syslog.target network.target ConditionFileIsExecutable=/usr/lib/gitlab-runner/gitlab-runner [Service] StartLimitInterval=5 StartLimitBurst=10 ExecStart=/usr/lib/gitlab-runner/gitlab-runner "run" "--working-directory" "/home/gitlab-runner/builds/" "--config" "/etc/gitlab-runner/config.toml" "--service" "gitlab-runner" "--syslog" "--user" "root" Restart=always RestartSec=120 [Install] WantedBy=multi-user.target
Some builds require root permissions to create or delete files at certain locations. Now gitlab-runner always throws errors. The reason is that the process gitlab-runner, although started as root, does sub-processes running as user gitlab-runner. Here is a snippet of my pipeline logfile
$ id -u 997 $ whoami gitlab-runner $ rm -rf /tmp/* rm: cannot remove ‘/tmp/ks-script-1yMUS_’: Operation not permitted rm: cannot remove ‘/tmp/ks-script-jNgpQ5’: Operation not permitted rm: cannot remove ‘/tmp/systemd-private-1838297d1ab047a99c3628869e77fd18-chronyd.service-z1RO0u’: Operation not permitted rm: cannot remove ‘/tmp/tmp.THBemf0N5O’: Operation not permitted rm: cannot remove ‘/tmp/yum.log’: Operation not permitted
How can I prevent gitlab-runner from starting sub-processes under another user?