diff options
| author | Ryan Hallisey <rhallise@redhat.com> | 2015-11-12 10:46:10 -0500 |
|---|---|---|
| committer | Ryan Hallisey <rhallise@redhat.com> | 2015-11-12 11:38:17 -0500 |
| commit | 22def41d37d8046541b25fca1fe806090bf14638 (patch) | |
| tree | a1a9bd9fac5c40126169a7c5908ead3aa50e677b /docker/rabbitmq | |
| parent | 55e4b54e23e96f0baae0fc49817a25152843d36c (diff) | |
| download | kolla-22def41d37d8046541b25fca1fe806090bf14638.tar.gz kolla-22def41d37d8046541b25fca1fe806090bf14638.zip | |
Drop root privileges for rabbitmq
Drop root privileges for rabbitmq. Only the rabbitmq user
will be able to execute chown of /var/lib/rabbitmq.
Change-Id: I546e6b475a8462bfbc75972854e1fee64f96d9cb
Partially-Implements: blueprint drop-root
Diffstat (limited to 'docker/rabbitmq')
| -rw-r--r-- | docker/rabbitmq/Dockerfile.j2 | 8 | ||||
| -rw-r--r-- | docker/rabbitmq/extend_start.sh | 2 | ||||
| -rw-r--r-- | docker/rabbitmq/rabbitmq_sudoers | 1 |
3 files changed, 9 insertions, 2 deletions
diff --git a/docker/rabbitmq/Dockerfile.j2 b/docker/rabbitmq/Dockerfile.j2 index f806f8977..fad8c4e4a 100644 --- a/docker/rabbitmq/Dockerfile.j2 +++ b/docker/rabbitmq/Dockerfile.j2 @@ -28,6 +28,12 @@ RUN /usr/lib/rabbitmq/bin/rabbitmq-plugins enable --offline \ && /bin/true COPY extend_start.sh /usr/local/bin/kolla_extend_start -RUN chmod 755 /usr/local/bin/kolla_extend_start +COPY rabbitmq_sudoers /etc/sudoers.d/rabbitmq_sudoers +RUN chmod 755 /usr/local/bin/kolla_extend_start \ + && chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/rabbitmq_sudoers \ + && usermod -a -G kolla rabbitmq {{ include_footer }} + +USER rabbitmq
\ No newline at end of file diff --git a/docker/rabbitmq/extend_start.sh b/docker/rabbitmq/extend_start.sh index e1c1007e3..06e71e810 100644 --- a/docker/rabbitmq/extend_start.sh +++ b/docker/rabbitmq/extend_start.sh @@ -3,8 +3,8 @@ # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases # of the KOLLA_BOOTSTRAP variable being set, including empty. if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then + sudo chown -R rabbitmq: /var/lib/rabbitmq echo "${RABBITMQ_CLUSTER_COOKIE}" > /var/lib/rabbitmq/.erlang.cookie - chown -R rabbitmq: /var/lib/rabbitmq chmod 400 /var/lib/rabbitmq/.erlang.cookie exit 0 fi diff --git a/docker/rabbitmq/rabbitmq_sudoers b/docker/rabbitmq/rabbitmq_sudoers new file mode 100644 index 000000000..7d3d091d8 --- /dev/null +++ b/docker/rabbitmq/rabbitmq_sudoers @@ -0,0 +1 @@ +%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R rabbitmq\: /var/lib/rabbitmq, /bin/chown -R rabbitmq\: /var/lib/rabbitmq |