fix(lambda): preserve Unix file permissions in zip2tar conversion#10021
fix(lambda): preserve Unix file permissions in zip2tar conversion#10021algojogacor wants to merge 2 commits into
Conversation
When zipinfo.external_attr >> 16 is 0 (common for Lambda ZIPs built on systems without Unix permissions, e.g. Windows or CI), the previous code skipped setting tarinfo.mode entirely, leaving it at 0000. This caused PermissionError when Lambda tried to read /var/task/index.py. Fix: always set tarinfo.mode from external_attr, then OR in minimum bits: - Files: 0o444 (read for all) - Dirs: 0o555 (read+execute for all) Closes getmoto#10021
Fix: zip2tar minimum permission enforcementThe root cause of the if zipinfo.external_attr >> 16:
tarinfo.mode = zipinfo.external_attr >> 16would silently skip setting Changes
This preserves original Unix permissions from ZIPs that have them, while guaranteeing that Lambda can always read the extracted files. |
Codecov Report❌ Patch coverage is
❌ Your patch check has failed because the patch coverage (75.00%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #10021 +/- ##
==========================================
- Coverage 93.21% 93.21% -0.01%
==========================================
Files 1328 1328
Lines 120736 120740 +4
==========================================
+ Hits 112541 112544 +3
- Misses 8195 8196 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
Summary
Fixes #9947
Lambda functions packaged as ZIP archives containing binaries with execute permissions (e.g., Go/Rust
bootstrapbinaries) fail withfork/exec /var/task/bootstrap: permission deniedbecausezip2tardoes not copy Unix file permissions from the ZIP archive to the TAR stream.Root Cause
In
moto/awslambda/models.py,zip2tarcreatesTarInfoobjects without settingmode.tarfile.TarInfodefaults to a mode without the execute bit (0o644), so binaries lose their execute permission during the ZIP-to-TAR conversion.The Unix permissions are stored in
zipinfo.external_attr(upper 16 bits), but this field is never read by the current implementation.Fix
Extract Unix permissions from
zipinfo.external_attr >> 16and apply them totarinfo.mode, preserving the original file permissions from the ZIP archive. Theif zipinfo.external_attr >> 16guard skips entries without Unix permission data (e.g., entries created on Windows).Changes
moto/awslambda/models.py: 2 lines added — extract and apply Unix permissions inzip2tarTesting