Description
We observed that in the most recent runner image, the directories /usr, /etc and some of their subdirectories are owned by runner instead of root.
I think that the ownership changes due to this commit and more explicitly these lines in install-container-tools.sh that unpack an archive directly to /.
Platforms affected
Runner images affected
Image version and build link
- Ubuntu 22.04: 20260726.241.1
- Ubuntu 24.04: 20260726.254.1
We did not test the whether the ARM runners are also affected.
Below are links to workflow runs that hit the new runner version and therefore /etc and /usr are owned by runner.
/usr
/etc
Is it regression?
Ubuntu 22.04: 20260720.234.2, Ubuntu 24.04: 20260720.247.2
Expected behavior
/etc, /usr, and subdirectories are owned by root such that only root can write to them.
Actual behavior
/etc, /usr, and some subdirectories are owned by runner such that the runner user can create new files or directories.
Repro steps
- Create a workflow that prints the ownership of
/etc or /usr (see below)
- Run the workflow until the worklow runs on a runner with the
20260726 image.
- Inspect the workflow's log to see that the owner of
/etc and /usr is runner instead of root.
Here is a repository to observe the ownership of /etc and /usr: https://github.com/ajaust/ubuntu-runner-usr-owner
It runs workflows on the ubuntu builds and prints the folder ownership and
Example for /etc:
name: Check /etc ownership
on:
workflow_dispatch:
jobs:
check-etc-ownership:
strategy:
fail-fast: false
matrix:
os: [ubuntu-22.04, ubuntu-24.04, ubuntu-26.04]
runs-on: ${{ matrix.os }}
steps:
- name: Print /etc ownership and permissions
run: |
echo "whoami: $(whoami)"
echo "id: $(id)"
echo
echo "ls -ld /etc:"
ls -ld /etc
echo
echo "stat /etc:"
stat /etc
echo
echo "ls -ld / /etc /etc/*:"
ls -ld / /etc /etc/*
Description
We observed that in the most recent runner image, the directories
/usr,/etcand some of their subdirectories are owned byrunnerinstead ofroot.I think that the ownership changes due to this commit and more explicitly these lines in
install-container-tools.shthat unpack an archive directly to/.Platforms affected
Runner images affected
Image version and build link
We did not test the whether the ARM runners are also affected.
Below are links to workflow runs that hit the new runner version and therefore
/etcand/usrare owned byrunner./usr/etcIs it regression?
Ubuntu 22.04: 20260720.234.2, Ubuntu 24.04: 20260720.247.2
Expected behavior
/etc,/usr, and subdirectories are owned byrootsuch that only root can write to them.Actual behavior
/etc,/usr, and some subdirectories are owned byrunnersuch that therunneruser can create new files or directories.Repro steps
/etcor/usr(see below)20260726image./etcand/usrisrunnerinstead ofroot.Here is a repository to observe the ownership of
/etcand/usr: https://github.com/ajaust/ubuntu-runner-usr-ownerIt runs workflows on the ubuntu builds and prints the folder ownership and
Example for
/etc: