Checklist
Mandatory Debugging Information
Optional Debugging Information
Related Issues and Possible Duplicates
Related Issues
DefectDojo/django-DefectDojo#3582
Possible Duplicates
Environment & Settings
Steps to Reproduce
I have come across this when running using OpenShift restricted SCC
oc logs defect-dojo-defectdojo-celery-worker-78dbb86b48-2rxn2
uid=1000640000(1000640000) gid=0(root) groups=0(root),1000640000
Waiting for database to be reachable [06/Jan/2021 13:40:58] INFO [dojo.models:3474] enabling audit logging
[06/Jan/2021 13:41:00] INFO [dojo.models:3474] enabling audit logging
Running a worker with superuser privileges when the
worker accepts messages serialized with pickle is a very bad idea!
If you really want to continue then you have to set the C_FORCE_ROOT
environment variable (but please think about this before you do).
User information: uid=1000640000 euid=1000640000 gid=0 egid=0
Required Dependencies
- Minimal Python Version: N/A
- Minimal Celery Version: 4.1.1
- Minimal Kombu Version: 4.1
- Minimal Broker Version: N/A
- Minimal Result Backend Version: N/A
- Minimal OS and/or Kernel Version: N/A
- Minimal Broker Client Version: N/A
- Minimal Result Backend Client Version: N/A
Python Packages
Other Dependencies
Minimally Reproducible Test Case
Expected Behavior
I believe that GID=0 doesn't give superuser privileges, so am not sure why the celery checks are implemented in this manner.
Actual Behavior
The gid (and egid) being 0 does not give superuser prvilieges
as stated - https://unix.stackexchange.com/questions/44077/what-does-it-mean-to-be-in-group-0 and https://docs.celeryproject.org/en/stable/userguide/daemonizing.html#running-the-worker-with-superuser-privileges-root
Checklist
masterbranch of Celery.contribution guide
on reporting bugs.
for similar or identical bug reports.
for existing proposed fixes.
to find out if the bug was already fixed in the master branch.
in this issue (If there are none, check this box anyway).
Mandatory Debugging Information
celery -A proj reportin the issue.(if you are not able to do this, then at least specify the Celery
version affected).
masterbranch of Celery.pip freezein the issue.to reproduce this bug.
Optional Debugging Information
and/or implementation.
result backend.
broker and/or result backend.
ETA/Countdown & rate limits disabled.
and/or upgrading Celery and its dependencies.
Related Issues and Possible Duplicates
Related Issues
DefectDojo/django-DefectDojo#3582
Possible Duplicates
Environment & Settings
Steps to Reproduce
I have come across this when running using OpenShift restricted SCC
Required Dependencies
Python Packages
Other Dependencies
Minimally Reproducible Test Case
Expected Behavior
I believe that GID=0 doesn't give superuser privileges, so am not sure why the celery checks are implemented in this manner.
Actual Behavior
The gid (and egid) being 0 does not give superuser prvilieges
as stated - https://unix.stackexchange.com/questions/44077/what-does-it-mean-to-be-in-group-0 and https://docs.celeryproject.org/en/stable/userguide/daemonizing.html#running-the-worker-with-superuser-privileges-root