feat(sudoers): let supabase-admin-agent invoke pgbackrest reconcile as root#2291
Draft
hunleyd wants to merge 5 commits into
Draft
feat(sudoers): let supabase-admin-agent invoke pgbackrest reconcile as root#2291hunleyd wants to merge 5 commits into
hunleyd wants to merge 5 commits into
Conversation
…s root The salt subcommand's systemd service runs as the unprivileged supabase-admin-agent OS user, but /etc/pgbackrest/conf.d is pgbackrest:postgres 02770 — only root/adminapi can write there. Adds a NOPASSWD sudoers entry for `pgbackrest reconcile`, mirroring the existing salt-call entry, so the salt cycle can elevate just this one command (via sudo) to keep async-archiving config in sync with billing tier (INDATA-996) without granting the supabase-admin-agent user any broader group membership.
This comment has been minimized.
This comment has been minimized.
…priv agent The new sudoers rule in this PR grants the supabase-admin-agent user NOPASSWD root exec of /opt/supabase-admin-agent/supabase-admin-agent, but the config dir, extracted archive, and symlink were all owned by that same low-priv user/group. Since sudo matches on path only (not content/hash), that account could replace the binary and use the new sudo grant to run arbitrary code as root. Own the dir/binary/symlink as root:root instead, matching the existing pgdata-chown/pgdata-signal pattern in this file — the agent process only needs to execute it, never write to it.
|
Found 6 test failures on Blacksmith runners: Failures
|
hunleyd
marked this pull request as ready for review
July 22, 2026 18:04
hunleyd
enabled auto-merge
July 22, 2026 18:05
hunleyd
marked this pull request as draft
July 23, 2026 01:52
auto-merge was automatically disabled
July 23, 2026 01:52
Pull request was converted to draft
spool-path was never set explicitly, so pgBackRest defaulted to /var/spool/pgbackrest, which lands on the AMI's root volume (10GB, shared with the OS/systemd/journal) rather than the /data EBS volume PGDATA lives on. archive-get's async replica-catch-up queue can hold several 16MB+ WAL segments at once; once archive-async is enabled fleet-wide (INDATA-996) that risks filling the root volume and taking the instance down. Points spool-path at /data/pgbackrest_spool instead, and updates the directory-creation task to match. Global option, set once at provisioning — no supabase-admin-agent changes needed.
2 tasks
…lume" This reverts commit 63a434a.
…rationale Single-line comments only per updated style rules: collapses the 4-line sudoers rationale into one line, and adds a why-comment on the new root:root ownership for /opt/supabase-admin-agent so a future edit doesn't revert it back to the unprivileged service account.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
saltsubcommand's systemd service runs as the unprivilegedsupabase-admin-agentOS user (groupsupabase-admin-agentonly), but/etc/pgbackrest/conf.dispgbackrest:postgres 02770— onlyroot/adminapi(in thepostgresgroup) can write there.NOPASSWDsudoers entry so the salt cycle can elevate justpgbackrest reconcileviasudo, mirroring the existingsalt-callentry in the same file — no broader group membership needed.Why this is safe
/opt/supabase-admin-agent/supabase-admin-agent pgbackrest reconcile— it can't be used to run anything else as root.supabase-admin-agentalready elevatessalt-callandgpgvia this exact mechanism (pkg/salt/exec.go); this isn't a new privilege model, just one more entry.visudo -cparses the file clean.Depends on
pgbackrest reconcilecommand this grants access to)Test plan
visudo -c -f ansible/files/supabase_admin_agent_config/supabase-admin-agent.sudoers.conf— parsed OKsudo-invokedpgbackrest reconcilesucceeds on a test instance without a password promptSmoke Test Results
PASS — test-postgres-pitr.sh (engine 17)
Command:
./scripts/test-postgres-pitr.sh 'https://github.com/supabase/postgres/pull/2291' --engine 17The script itself reported a failure at the final health-check step because the invocation was initially missing an unrelated CLI credential (
SUPADEV_SYSTEM_API_KEY) — backup creation and PITR restore both succeeded before that point. Re-running just the health check (supadev project-health <restored-project>) once the credential was set confirmed all componentsACTIVE_HEALTHY(Storage, Realtime, Postgres (Admin), Postgres (User), Supavisor (TXN), PgBouncer, and others). Net result: PITR backup/restore works correctly with this PR's ansible ownership change.SKIPPED — test-postgres-pause-restore.sh (engine 17)
Command:
./scripts/test-postgres-pause-restore.sh 'https://github.com/supabase/postgres/pull/2291' --engine 17Blocked by a pre-existing local dev-stack defect ("IPv6 address is not defined for this project", 500 from mgmt-api) unrelated to this PR's diff (ansible sudoers/ownership only) — OrbStack's
ipv6config was already correct, so the fix requires an engine restart that drops every container on the host. Skipped rather than disrupt other work; PITR is the test most directly relevant to this diff's pgbackrest/archiving change and passed cleanly.