Skip to content

[Ubuntu] Owner of /etc and /usr changed from root to runner in 20260726 #14477

Description

@ajaust

Description

We observed that in the most recent runner image, the directories /usr, /etc and some of their subdirectories are owned by runner instead of root.

I think that the ownership changes due to this commit and more explicitly these lines in install-container-tools.sh that unpack an archive directly to /.

Platforms affected

  • Azure DevOps
  • GitHub Actions - Standard Runners
  • GitHub Actions - Larger Runners

Runner images affected

  • Ubuntu 22.04
  • Ubuntu 22.04 Arm64
  • Ubuntu 24.04
  • Ubuntu 24.04 Arm64
  • Ubuntu 26.04
  • Ubuntu 26.04 Arm64
  • Ubuntu Slim
  • macOS 14
  • macOS 14 Arm64
  • macOS 15
  • macOS 15 Arm64
  • macOS 26
  • macOS 26 Arm64
  • Windows Server 2022
  • Windows Server 2025
  • Windows Server 2025 with Visual Studio 2026
  • Windows Desktop 11
  • Windows Desktop 11 with Visual Studio 2026

Image version and build link

  • Ubuntu 22.04: 20260726.241.1
  • Ubuntu 24.04: 20260726.254.1

We did not test the whether the ARM runners are also affected.

Below are links to workflow runs that hit the new runner version and therefore /etc and /usr are owned by runner.

/usr

/etc

Is it regression?

Ubuntu 22.04: 20260720.234.2, Ubuntu 24.04: 20260720.247.2

Expected behavior

/etc, /usr, and subdirectories are owned by root such that only root can write to them.

Actual behavior

/etc, /usr, and some subdirectories are owned by runner such that the runner user can create new files or directories.

Repro steps

  1. Create a workflow that prints the ownership of /etc or /usr (see below)
  2. Run the workflow until the worklow runs on a runner with the 20260726 image.
  3. Inspect the workflow's log to see that the owner of /etc and /usr is runner instead of root.

Here is a repository to observe the ownership of /etc and /usr: https://github.com/ajaust/ubuntu-runner-usr-owner

It runs workflows on the ubuntu builds and prints the folder ownership and

Example for /etc:

name: Check /etc ownership

on:
  workflow_dispatch:

jobs:
  check-etc-ownership:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, ubuntu-24.04, ubuntu-26.04]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Print /etc ownership and permissions
        run: |
          echo "whoami: $(whoami)"
          echo "id: $(id)"
          echo
          echo "ls -ld /etc:"
          ls -ld /etc
          echo
          echo "stat /etc:"
          stat /etc
          echo
          echo "ls -ld / /etc /etc/*:"
          ls -ld / /etc /etc/*

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions