diff options
| author | Vladislav Belogrudov <vladislav.belogrudov@oracle.com> | 2016-12-20 13:53:33 +0300 |
|---|---|---|
| committer | Vladislav Belogrudov <vladislav.belogrudov@oracle.com> | 2017-02-03 08:49:39 +0000 |
| commit | aae9193675ed214f7a4455708409532ea1665255 (patch) | |
| tree | 1388d28596d8cd363dc0bd93d8bcc29270d04e9c /docker/nova | |
| parent | 95bb052fe75117ccad3d435c8af58bd3b74f0ee2 (diff) | |
| download | kolla-aae9193675ed214f7a4455708409532ea1665255.tar.gz kolla-aae9193675ed214f7a4455708409532ea1665255.zip | |
Containerized sshd does not work with older PAM
sshd containers don't let logins on some systems with older
PAM library because /proc/self/loginuid is not always readable
or writeable. Examples of possible failures on such systems are
erroneous cold and live migrations.
This fix does not upgrade PAM but makes pam_loginuid optional
for nova_ssh and keystone_ssh.
More information:
https://github.com/docker/docker/issues/5663
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726661
https://git.fedorahosted.org/cgit/linux-pam.git/tree/modules/pam_loginuid/pam_loginuid.c#n61
Change-Id: Ic14255b042ceedcff536c062bdcba00502af7a87
Closes-Bug: #1651395
Diffstat (limited to 'docker/nova')
| -rw-r--r-- | docker/nova/nova-ssh/Dockerfile.j2 | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docker/nova/nova-ssh/Dockerfile.j2 b/docker/nova/nova-ssh/Dockerfile.j2 index 2ec3b5a5b..3b4ded412 100644 --- a/docker/nova/nova-ssh/Dockerfile.j2 +++ b/docker/nova/nova-ssh/Dockerfile.j2 @@ -18,7 +18,8 @@ RUN mkdir -p /var/run/sshd \ {{ macros.install_packages(nova_ssh_packages | customizable("packages")) }} -RUN chsh -s /bin/bash nova +RUN chsh -s /bin/bash nova \ + && sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd COPY extend_start.sh /usr/local/bin/kolla_extend_start RUN chmod 755 /usr/local/bin/kolla_extend_start |