java: only set nobody user on Unix (#25648)

In #25496 we introduced the ability to have `task.user` set for on Windows, so
long as the user ID fits a particular shape. But this uncovered a 7 year old bug
in the `java` driver introduced in #5143, where we set the `task.user` to the
non-existent Unix user `nobody`, even if we're running on Windows.

Prior to the change in #25496 we always ignored the `task.user`, so this was not
a problem. We don't set the `task.user` in the `raw_exec` driver, and the
otherwise very similar `exec` driver is Linux-only, so we never see the problem
there.

Fix the bug in the `java` driver by gating the change to the `task.user` on not
being Windows. Also add a check to the new code path that the user is non-empty
before parsing it, so that any third party drivers that might be borrowing the
executor code don't hit the same probem on Windows.

Ref: https://github.com/hashicorp/nomad/pull/5143
Ref: https://github.com/hashicorp/nomad/pull/25496
Fixes: https://github.com/hashicorp/nomad/issues/25638
This commit is contained in:
Tim Gross
2025-04-10 10:34:34 -04:00
committed by GitHub
parent 8b33584fbf
commit 48f304d0ca
3 changed files with 7 additions and 1 deletions

3
.changelog/25648.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
java: Fixed a bug where the default task user was set to 'nobody' on Windows
```

View File

@@ -468,7 +468,7 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (handle *drivers.TaskHandle,
}
user := cfg.User
if user == "" {
if user == "" && runtime.GOOS != "windows" {
user = "nobody"
}

View File

@@ -44,6 +44,9 @@ func withNetworkIsolation(f func() error, _ *drivers.NetworkIsolationSpec) error
}
func setCmdUser(cmd *exec.Cmd, user string) error {
if user == "" {
return nil
}
nameParts := strings.Split(user, "\\")
if len(nameParts) != 2 {
return errors.New("user name must contain domain")