From 4653d3f9591a2f39510907d34886779bdcf489c2 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 29 Jul 2026 15:44:39 -0400 Subject: [PATCH] Move ssh scratch location out of /tmp /tmp is sometimes locked down, move it into the runtime directory instead. --- confluent_server/confluent/sshutil.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/confluent_server/confluent/sshutil.py b/confluent_server/confluent/sshutil.py index 7f0a81b9..7b2e71d3 100644 --- a/confluent_server/confluent/sshutil.py +++ b/confluent_server/confluent/sshutil.py @@ -44,7 +44,13 @@ async def assure_agent(): if agent_pid is None: try: agent_starting = True - agent_tmpdir = tempfile.mkdtemp() + try: + os.makedirs('/run/confluent/ssh', mode=0o700) + except OSError as e: + if e.errno != 17: + raise + os.chmod('/run/confluent/ssh', 0o700) + agent_tmpdir = tempfile.mkdtemp(dir='/run/confluent/ssh', prefix='agent.') os.chmod(agent_tmpdir, 0o700) sockpath = os.path.join(agent_tmpdir, 'agent.sock') sai = (await util.check_output(['ssh-agent', '-a', sockpath]))[0] @@ -149,7 +155,13 @@ async def prep_ssh_key(keyname): ready_keys[keyname] = 1 adding_key = False return - tmpdir = tempfile.mkdtemp() + try: + os.makedirs('/run/confluent/ssh', mode=0o700) + except OSError as e: + if e.errno != 17: + raise + os.chmod('/run/confluent/ssh', 0o700) + tmpdir = tempfile.mkdtemp(dir='/run/confluent/ssh', prefix='askpass.') try: askpass = os.path.join(tmpdir, 'askpass.sh') with open(askpass, 'w') as ap: