EDM-2954: Allow configuring app privileges

libs/i18n/locales/en/translation.json

@@ -265,6 +265,7 @@
   "Device applications table": "Device applications table",
   "Ready": "Ready",
   "Restarts": "Restarts",
+  "Run as user": "Run as user",
   "Embedded": "Embedded",
   "Yes": "Yes",
   "No": "No",
@@ -400,6 +401,13 @@
   "Content is base64 encoded": "Content is base64 encoded",
   "Delete file": "Delete file",
   "Add file": "Add file",
+  "Access & permissions": "Access & permissions",
+  "System integrity protection": "System integrity protection",
+  "System integrity protection enabled": "System integrity protection enabled",
+  "System integrity protection disabled": "System integrity protection disabled",
+  "Prevents this workload from modifying critical host operating system files. We recommend keeping this enabled to maintain system integrity.": "Prevents this workload from modifying critical host operating system files. We recommend keeping this enabled to maintain system integrity.",
+  "Rootless user identity": "Rootless user identity",
+  "By default, workloads run as the '{{ runAsUser }}' user. To specify a custom user identity, edit the application configuration via YAML or CLI.": "By default, workloads run as the '{{ runAsUser }}' user. To specify a custom user identity, edit the application configuration via YAML or CLI.",
   "Application {{ appNum }}": "Application {{ appNum }}",
   "Application type": "Application type",
   "Select an application type": "Select an application type",

libs/types/models/ApplicationProviderSpec.ts

@@ -12,5 +12,9 @@ export type ApplicationProviderSpec = (ApplicationEnvVars & {
    */
   name?: string;
   appType: AppType;
+  /**
+   * The username of the system user this application should be run under. This is not the same as the user within any containers of the application (if applicable). Defaults to the user that the agent runs as (generally root) if not specified.
+   */
+  runAs?: string;
 } & (ImageApplicationProviderSpec | InlineApplicationProviderSpec));
 

libs/types/models/DeviceApplicationStatus.ts

@@ -24,6 +24,10 @@ export type DeviceApplicationStatus = {
    */
   embedded: boolean;
   appType: AppType;
+  /**
+   * The username of the system user this application is runing under. If blank, the application is run as the same user as the agent (generally root).
+   */
+  runAs?: string;
   /**
    * Status of volumes used by this application.
    */

libs/ui-components/src/components/DetailsPage/Tables/ApplicationsTable.tsx

@@ -6,6 +6,7 @@ import { DeviceApplicationStatus } from '@flightctl/types';
 import { useTranslation } from '../../../hooks/useTranslation';
 import ApplicationStatus from '../../Status/ApplicationStatus';
 import { getAppTypeLabel } from '../../../utils/apps';
+import { RUN_AS_DEFAULT_USER } from '../../../types/deviceSpec';
 
 type ApplicationsTableProps = {
   appsStatus: DeviceApplicationStatus[];
@@ -27,6 +28,7 @@ const ApplicationsTable = ({ appsStatus }: ApplicationsTableProps) => {
           <Th modifier="wrap">{t('Ready')}</Th>
           <Th modifier="wrap">{t('Restarts')}</Th>
           <Th modifier="wrap">{t('Type')}</Th>
+          <Th modifier="wrap">{t('Run as user')}</Th>
           <Th modifier="wrap">{t('Embedded')}</Th>
         </Tr>
       </Thead>
@@ -43,6 +45,7 @@ const ApplicationsTable = ({ appsStatus }: ApplicationsTableProps) => {
               <Td dataLabel={t('Type')}>
                 {app.appType ? <Label variant="outline">{getAppTypeLabel(app.appType, t)}</Label> : '-'}
               </Td>
+              <Td dataLabel={t('Run as user')}>{app.runAs || RUN_AS_DEFAULT_USER}</Td>
               <Td dataLabel={t('Embedded')}>{app.embedded ? t('Yes') : t('No')}</Td>
             </Tr>
           );