fix(lockfiles): fix privileges in lockfile scan (#1512)

* fix(lockfiles): fix privileges in lockfile scan

* style(fmt): add space in comment line

scanner/base.go

@@ -398,10 +398,24 @@ func (l *base) detectRunningOnAws() (ok bool, instanceID string, err error) {
 		r := l.exec(cmd, noSudo)
 		if r.isSuccess() {
 			id := strings.TrimSpace(r.Stdout)
-			if !l.isAwsInstanceID(id) {
-				return false, "", nil
+			if l.isAwsInstanceID(id) {
+				return true, id, nil
+			}
+		}
+
+		cmd = "curl -X PUT --max-time 1 --noproxy 169.254.169.254 -H \"X-aws-ec2-metadata-token-ttl-seconds: 300\" http://169.254.169.254/latest/api/token"
+		r = l.exec(cmd, noSudo)
+		if r.isSuccess() {
+			token := strings.TrimSpace(r.Stdout)
+			cmd = fmt.Sprintf("curl -H \"X-aws-ec2-metadata-token: %s\" --max-time 1 --noproxy 169.254.169.254 http://169.254.169.254/latest/meta-data/instance-id", token)
+			r = l.exec(cmd, noSudo)
+			if r.isSuccess() {
+				id := strings.TrimSpace(r.Stdout)
+				if !l.isAwsInstanceID(id) {
+					return false, "", nil
+				}
+				return true, id, nil
 			}
-			return true, id, nil
 		}
 
 		switch r.ExitStatus {
@@ -589,6 +603,11 @@ func (l *base) scanLibraries() (err error) {
 	libFilemap := map[string]LibFile{}
 	detectFiles := l.ServerInfo.Lockfiles
 
+	priv := noSudo
+	if l.getServerInfo().Mode.IsFastRoot() || l.getServerInfo().Mode.IsDeep() {
+		priv = sudo
+	}
+
 	// auto detect lockfile
 	if l.ServerInfo.FindLock {
 		findopt := ""
@@ -599,7 +618,7 @@ func (l *base) scanLibraries() (err error) {
 		// delete last "-o "
 		// find / -type f -and \( -name "package-lock.json" -o -name "yarn.lock" ... \) 2>&1 | grep -v "find: "
 		cmd := fmt.Sprintf(`find / -type f -and \( ` + findopt[:len(findopt)-3] + ` \) 2>&1 | grep -v "find: "`)
-		r := exec(l.ServerInfo, cmd, noSudo)
+		r := exec(l.ServerInfo, cmd, priv)
 		if r.ExitStatus != 0 && r.ExitStatus != 1 {
 			return xerrors.Errorf("Failed to find lock files")
 		}
@@ -634,7 +653,7 @@ func (l *base) scanLibraries() (err error) {
 			}
 		default:
 			cmd := fmt.Sprintf(`stat -c "%%a" %s`, path)
-			r := exec(l.ServerInfo, cmd, noSudo)
+			r := exec(l.ServerInfo, cmd, priv)
 			if !r.isSuccess() {
 				return xerrors.Errorf("Failed to get target file permission: %s, filepath: %s", r, path)
 			}
@@ -646,7 +665,7 @@ func (l *base) scanLibraries() (err error) {
 			f.Filemode = os.FileMode(perm)
 
 			cmd = fmt.Sprintf("cat %s", path)
-			r = exec(l.ServerInfo, cmd, noSudo)
+			r = exec(l.ServerInfo, cmd, priv)
 			if !r.isSuccess() {
 				return xerrors.Errorf("Failed to get target file contents: %s, filepath: %s", r, path)
 			}
@@ -771,13 +790,13 @@ func (d *DummyFileInfo) Size() int64 { return d.size }
 // Mode is
 func (d *DummyFileInfo) Mode() os.FileMode { return d.filemode }
 
-//ModTime is
+// ModTime is
 func (d *DummyFileInfo) ModTime() time.Time { return time.Now() }
 
 // IsDir is
 func (d *DummyFileInfo) IsDir() bool { return false }
 
-//Sys is
+// Sys is
 func (d *DummyFileInfo) Sys() interface{} { return nil }
 
 func (l *base) scanWordPress() error {