diff options
| author | Hongbin Lu <hongbin034@gmail.com> | 2018-08-18 21:52:26 +0000 |
|---|---|---|
| committer | Hongbin Lu <hongbin034@gmail.com> | 2018-08-27 01:55:18 +0000 |
| commit | 0b2682e489fe67a6f43596ea61291d92107c3569 (patch) | |
| tree | 5eb1172878fafacbcccb6c6d51c2dc666e3d9a91 | |
| parent | 8d44e3b5a4837f454856b80f032c4ad17325a595 (diff) | |
| download | kolla-0b2682e489fe67a6f43596ea61291d92107c3569.tar.gz kolla-0b2682e489fe67a6f43596ea61291d92107c3569.zip | |
Configure sudoers for zun containers
Zun processes were run as user 'root' in before. This is undesirable
for several reasons (i.e. security, privsep). This patch make the
Zun processes run as 'zun' user, which aligns with the practice of
other containers.
Change-Id: I0d3111f0ca6301d6f22410fe5fd5a2dbf586e691
Closes-Bug: #1787760
| -rw-r--r-- | docker/zun/zun-api/Dockerfile.j2 | 2 | ||||
| -rw-r--r-- | docker/zun/zun-base/Dockerfile.j2 | 5 | ||||
| -rw-r--r-- | docker/zun/zun-base/zun_sudoers | 1 | ||||
| -rw-r--r-- | docker/zun/zun-compute/Dockerfile.j2 | 2 | ||||
| -rw-r--r-- | docker/zun/zun-wsproxy/Dockerfile.j2 | 2 |
5 files changed, 11 insertions, 1 deletions
diff --git a/docker/zun/zun-api/Dockerfile.j2 b/docker/zun/zun-api/Dockerfile.j2 index 19e73ffb0..01f665b43 100644 --- a/docker/zun/zun-api/Dockerfile.j2 +++ b/docker/zun/zun-api/Dockerfile.j2 @@ -15,3 +15,5 @@ RUN chmod 755 /usr/local/bin/kolla_zun_extend_start {% block zun_api_footer %}{% endblock %} {% block footer %}{% endblock %} + +USER zun diff --git a/docker/zun/zun-base/Dockerfile.j2 b/docker/zun/zun-base/Dockerfile.j2 index 9f502ae9c..4e887bcee 100644 --- a/docker/zun/zun-base/Dockerfile.j2 +++ b/docker/zun/zun-base/Dockerfile.j2 @@ -56,9 +56,12 @@ RUN ln -s zun-base-source/* zun \ {% endif %} +COPY zun_sudoers /etc/sudoers.d/kolla_zun_sudoers COPY extend_start.sh /usr/local/bin/kolla_extend_start -RUN touch /usr/local/bin/kolla_zun_extend_start \ +RUN chmod 750 /etc/sudoers.d \ + && chmod 640 /etc/sudoers.d/kolla_zun_sudoers \ + && touch /usr/local/bin/kolla_zun_extend_start \ && chmod 755 /var/www/cgi-bin/zun \ && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_zun_extend_start diff --git a/docker/zun/zun-base/zun_sudoers b/docker/zun/zun-base/zun_sudoers new file mode 100644 index 000000000..fd35f4cb5 --- /dev/null +++ b/docker/zun/zun-base/zun_sudoers @@ -0,0 +1 @@ +zun ALL=(root) NOPASSWD: /var/lib/kolla/venv/bin/zun-rootwrap /etc/zun/rootwrap.conf * diff --git a/docker/zun/zun-compute/Dockerfile.j2 b/docker/zun/zun-compute/Dockerfile.j2 index a469598ec..23ab689f7 100644 --- a/docker/zun/zun-compute/Dockerfile.j2 +++ b/docker/zun/zun-compute/Dockerfile.j2 @@ -12,3 +12,5 @@ RUN echo '{{ install_type }} not yet available for {{ base_distro }}' \ {% block zun_compute_footer %}{% endblock %} {% block footer %}{% endblock %} + +USER zun diff --git a/docker/zun/zun-wsproxy/Dockerfile.j2 b/docker/zun/zun-wsproxy/Dockerfile.j2 index 67cfe1f2b..4c14c5072 100644 --- a/docker/zun/zun-wsproxy/Dockerfile.j2 +++ b/docker/zun/zun-wsproxy/Dockerfile.j2 @@ -12,3 +12,5 @@ RUN echo '{{ install_type }} not yet available for {{ base_distro }}' \ {% block zun_wsproxy_footer %}{% endblock %} {% block footer %}{% endblock %} + +USER zun |