diff options
| author | Jenkins <jenkins@review.openstack.org> | 2015-11-12 13:13:50 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2015-11-12 13:13:50 +0000 |
| commit | 55e4b54e23e96f0baae0fc49817a25152843d36c (patch) | |
| tree | 0cb341f61f6cc4317069553bd04abb96cda139c7 | |
| parent | 336074a6c325ded7b6ab3a890cafb385f5537833 (diff) | |
| parent | 4c9e15b94e3f8e27a3ef194768c64357efa9ea82 (diff) | |
| download | kolla-55e4b54e23e96f0baae0fc49817a25152843d36c.tar.gz kolla-55e4b54e23e96f0baae0fc49817a25152843d36c.zip | |
Merge "Drop root privileges for mariadb"
| -rw-r--r-- | docker/base/sudoers | 2 | ||||
| -rw-r--r-- | docker/mariadb/Dockerfile.j2 | 9 | ||||
| -rw-r--r-- | docker/mariadb/extend_start.sh | 8 | ||||
| -rw-r--r-- | docker/mariadb/mariadb_sudoers | 1 |
4 files changed, 15 insertions, 5 deletions
diff --git a/docker/base/sudoers b/docker/base/sudoers index 0205b920f..76baefcb0 100644 --- a/docker/base/sudoers +++ b/docker/base/sudoers @@ -14,3 +14,5 @@ root ALL=(ALL) ALL # anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the # root user via sudo without password confirmation %kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs + +#includedir /etc/sudoers.d diff --git a/docker/mariadb/Dockerfile.j2 b/docker/mariadb/Dockerfile.j2 index a840d9b8d..d36504894 100644 --- a/docker/mariadb/Dockerfile.j2 +++ b/docker/mariadb/Dockerfile.j2 @@ -28,9 +28,16 @@ RUN apt-get install -y --no-install-recommends \ {% endif %} +COPY mariadb_sudoers /etc/sudoers.d/mariadb_sudoers COPY extend_start.sh /usr/local/bin/kolla_extend_start COPY security_reset.expect /usr/local/bin/kolla_security_reset RUN chmod 755 /usr/local/bin/kolla_extend_start \ - && chmod 755 /usr/local/bin/kolla_security_reset + && chmod 755 /usr/local/bin/kolla_security_reset \ + && chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/mariadb_sudoers \ + && usermod -a -G kolla mysql + + +USER mysql {{ include_footer }} diff --git a/docker/mariadb/extend_start.sh b/docker/mariadb/extend_start.sh index 8a8699b88..2ff24b73b 100644 --- a/docker/mariadb/extend_start.sh +++ b/docker/mariadb/extend_start.sh @@ -5,19 +5,19 @@ function bootstrap_db { # Waiting for deamon sleep 10 - kolla_security_reset + sudo -E kolla_security_reset mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;" mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;" - mysqladmin -p"${DB_ROOT_PASSWORD}" shutdown + mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown } -chown mysql: /var/lib/mysql +sudo chown mysql: /var/lib/mysql # This catches all cases of the BOOTSTRAP variable being set, including empty if [[ "${!KOLLA_BOOTSTRAP[@]}" ]] && [[ ! -e /var/lib/mysql/cluster.exists ]]; then ARGS="--wsrep-new-cluster" touch /var/lib/mysql/cluster.exists - mysql_install_db --user=mysql + mysql_install_db bootstrap_db fi diff --git a/docker/mariadb/mariadb_sudoers b/docker/mariadb/mariadb_sudoers new file mode 100644 index 000000000..c95b1e2ad --- /dev/null +++ b/docker/mariadb/mariadb_sudoers @@ -0,0 +1 @@ +%kolla ALL=(root) NOPASSWD: /bin/chown mysql\: /var/lib/mysql, /usr/bin/chown mysql\: /var/lib/mysql, /usr/local/bin/kolla_security_reset |