Adjust permissions on _extend_start files.

Explicitly set the permissions on the kolla-toolbox kolla_extend_start
file. Also, since all extend_start files are sourced rather than
executed, the executable bits are now cleared throughout the project.

Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0

71 files changed, 75 insertions, 70 deletions

diff --git a/docker/aodh/aodh-base/Dockerfile.j2 b/docker/aodh/aodh-base/Dockerfile.j2
index cd61ca21a..2712ed721 100644
--- a/docker/aodh/aodh-base/Dockerfile.j2
+++ b/docker/aodh/aodh-base/Dockerfile.j2
@@ -34,6 +34,6 @@ RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_aodh_sudoers \
     && chmod 755 /var/www/cgi-bin/aodh \
     && touch /usr/local/bin/kolla_aodh_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_aodh_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_aodh_extend_start
 
 {% block aodh_base_footer %}{% endblock %}
diff --git a/docker/barbican/barbican-base/Dockerfile.j2 b/docker/barbican/barbican-base/Dockerfile.j2
index 3f749a5f3..07961b9ad 100644
--- a/docker/barbican/barbican-base/Dockerfile.j2
+++ b/docker/barbican/barbican-base/Dockerfile.j2
@@ -37,6 +37,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_barbican_sudoers \
     && touch /usr/local/bin/kolla_barbican_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_barbican_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_barbican_extend_start
 
 {% block barbican_base_footer %}{% endblock %}
diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2
index fd18fa893..cf17be0f6 100644
--- a/docker/base/Dockerfile.j2
+++ b/docker/base/Dockerfile.j2
@@ -384,7 +384,8 @@ RUN chmod 755 /usr/local/bin/healthcheck_*
 {% endif %}
 
 RUN touch /usr/local/bin/kolla_extend_start \
-    && chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_set_configs /usr/local/bin/kolla_copy_cacerts /usr/local/bin/kolla_httpd_setup \
+    && chmod 755 /usr/local/bin/kolla_start /usr/local/bin/kolla_set_configs /usr/local/bin/kolla_copy_cacerts \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_httpd_setup \
     && chmod 440 /etc/sudoers \
     && mkdir -p /var/log/kolla \
     && chown :kolla /var/log/kolla \
diff --git a/docker/blazar/blazar-base/Dockerfile.j2 b/docker/blazar/blazar-base/Dockerfile.j2
index 5cca6e4d1..b172c4bf4 100644
--- a/docker/blazar/blazar-base/Dockerfile.j2
+++ b/docker/blazar/blazar-base/Dockerfile.j2
@@ -24,6 +24,6 @@ RUN ln -s blazar-base-source/* blazar \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_blazar_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_blazar_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_blazar_extend_start
 
 {% block blazar_base_footer %}{% endblock %}
diff --git a/docker/ceilometer/ceilometer-base/Dockerfile.j2 b/docker/ceilometer/ceilometer-base/Dockerfile.j2
index 31931d148..85f306f52 100644
--- a/docker/ceilometer/ceilometer-base/Dockerfile.j2
+++ b/docker/ceilometer/ceilometer-base/Dockerfile.j2
@@ -37,6 +37,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_ceilometer_sudoers \
     && touch /usr/local/bin/kolla_ceilometer_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_ceilometer_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_ceilometer_extend_start
 
 {% block ceilometer_base_footer %}{% endblock %}
diff --git a/docker/cinder/cinder-base/Dockerfile.j2 b/docker/cinder/cinder-base/Dockerfile.j2
index 9503163b3..cf6f728e8 100644
--- a/docker/cinder/cinder-base/Dockerfile.j2
+++ b/docker/cinder/cinder-base/Dockerfile.j2
@@ -49,6 +49,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_cinder_sudoers \
     && touch /usr/local/bin/kolla_cinder_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cinder_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cinder_extend_start
 
 {% block cinder_base_footer %}{% endblock %}
diff --git a/docker/cloudkitty/cloudkitty-base/Dockerfile.j2 b/docker/cloudkitty/cloudkitty-base/Dockerfile.j2
index 641812846..adaa18c59 100644
--- a/docker/cloudkitty/cloudkitty-base/Dockerfile.j2
+++ b/docker/cloudkitty/cloudkitty-base/Dockerfile.j2
@@ -23,6 +23,6 @@ RUN ln -s cloudkitty-base-source/* cloudkitty \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_cloudkitty_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cloudkitty_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cloudkitty_extend_start
 
 {% block cloudkitty_base_footer %}{% endblock %}
diff --git a/docker/collectd/Dockerfile.j2 b/docker/collectd/Dockerfile.j2
index fab16e161..0190b71f5 100644
--- a/docker/collectd/Dockerfile.j2
+++ b/docker/collectd/Dockerfile.j2
@@ -72,7 +72,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.install_packages(collectd_packages | customizable("packages")) }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start \
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && chown -R collectd /var/lib/collectd \
     && chown -R collectd /etc/collectd* \
     && chown -R collectd /var/run/
diff --git a/docker/cron/Dockerfile.j2 b/docker/cron/Dockerfile.j2
index 9acf99b81..fbbd68500 100644
--- a/docker/cron/Dockerfile.j2
+++ b/docker/cron/Dockerfile.j2
@@ -22,7 +22,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.install_packages(cron_packages | customizable("packages")) }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block cron_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/cyborg/cyborg-base/Dockerfile.j2 b/docker/cyborg/cyborg-base/Dockerfile.j2
index 1373cb9b2..bf0fc2be2 100644
--- a/docker/cyborg/cyborg-base/Dockerfile.j2
+++ b/docker/cyborg/cyborg-base/Dockerfile.j2
@@ -25,6 +25,6 @@ COPY cyborg_sudoers /etc/sudoers.d/kolla_cyborg_sudoers
 
 RUN chmod 750 /etc/sudoers.d \
     && touch /usr/local/bin/kolla_cyborg_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cyborg_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_cyborg_extend_start
 
 {% block cyborg_footer %}{% endblock %}
diff --git a/docker/designate/designate-base/Dockerfile.j2 b/docker/designate/designate-base/Dockerfile.j2
index 385c4d57b..916315840 100644
--- a/docker/designate/designate-base/Dockerfile.j2
+++ b/docker/designate/designate-base/Dockerfile.j2
@@ -28,6 +28,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_designate_sudoers \
     && touch /usr/local/bin/kolla_designate_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_designate_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_designate_extend_start
 
 {% block designate_base_footer %}{% endblock %}
diff --git a/docker/elasticsearch/elasticsearch-curator/Dockerfile.j2 b/docker/elasticsearch/elasticsearch-curator/Dockerfile.j2
index 2cde977c1..0ce0927a9 100644
--- a/docker/elasticsearch/elasticsearch-curator/Dockerfile.j2
+++ b/docker/elasticsearch/elasticsearch-curator/Dockerfile.j2
@@ -36,7 +36,7 @@ RUN {{ macros.install_pip(['pip', 'wheel', 'setuptools'], constraints=false) }}
     && chown -R elasticsearch: /etc/elasticsearch-curator
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block elasticsearch_curator_base_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/elasticsearch/elasticsearch/Dockerfile.j2 b/docker/elasticsearch/elasticsearch/Dockerfile.j2
index 88b67b1f7..e4135c153 100644
--- a/docker/elasticsearch/elasticsearch/Dockerfile.j2
+++ b/docker/elasticsearch/elasticsearch/Dockerfile.j2
@@ -46,7 +46,7 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 #
 # https://discuss.elastic.co/t/running-as-non-root-user-service-wrapper-has-changed/7863
 
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block elasticsearch_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/etcd/Dockerfile.j2 b/docker/etcd/Dockerfile.j2
index 956f80352..dc39acbe2 100644
--- a/docker/etcd/Dockerfile.j2
+++ b/docker/etcd/Dockerfile.j2
@@ -19,7 +19,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 COPY etcd_sudoers /etc/sudoers.d/kolla_etcd_sudoers
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
-RUN chmod 755 /usr/local/bin/kolla_extend_start \
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_etcd_sudoers
 
diff --git a/docker/fluentd/Dockerfile.j2 b/docker/fluentd/Dockerfile.j2
index c1bf7065b..34853eedc 100644
--- a/docker/fluentd/Dockerfile.j2
+++ b/docker/fluentd/Dockerfile.j2
@@ -46,7 +46,7 @@ RUN chmod 440 /etc/sudoers.d/kolla_fluentd_sudoers \
     && chown -R {{ fluentd_user }}: /etc/{{ fluentd_user }} /var/run/{{ fluentd_user }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block fluentd_plugins_install %}
 
diff --git a/docker/freezer/freezer-base/Dockerfile.j2 b/docker/freezer/freezer-base/Dockerfile.j2
index 6cf186d57..56d2dfa3a 100644
--- a/docker/freezer/freezer-base/Dockerfile.j2
+++ b/docker/freezer/freezer-base/Dockerfile.j2
@@ -34,6 +34,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_freezer_sudoers \
     && touch /usr/local/bin/kolla_freezer_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_freezer_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_freezer_extend_start
 
 {% block freezer_base_footer %}{% endblock %}
diff --git a/docker/glance/glance-base/Dockerfile.j2 b/docker/glance/glance-base/Dockerfile.j2
index c51a3b338..65cfbb940 100644
--- a/docker/glance/glance-base/Dockerfile.j2
+++ b/docker/glance/glance-base/Dockerfile.j2
@@ -48,6 +48,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_glance_sudoers \
     && touch /usr/local/bin/kolla_glance_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_glance_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_glance_extend_start
 
 {% block glance_base_footer %}{% endblock %}
diff --git a/docker/gnocchi/gnocchi-base/Dockerfile.j2 b/docker/gnocchi/gnocchi-base/Dockerfile.j2
index 9465c9537..4a12b97bf 100644
--- a/docker/gnocchi/gnocchi-base/Dockerfile.j2
+++ b/docker/gnocchi/gnocchi-base/Dockerfile.j2
@@ -49,6 +49,6 @@ COPY gnocchi_sudoers /etc/sudoers.d/kolla_gnocchi_sudoers
 RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_gnocchi_sudoers \
     && touch /usr/local/bin/kolla_gnocchi_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_gnocchi_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_gnocchi_extend_start
 
 {% block gnocchi_base_footer %}{% endblock %}
diff --git a/docker/grafana/Dockerfile.j2 b/docker/grafana/Dockerfile.j2
index 2f69e7672..8c21665f9 100644
--- a/docker/grafana/Dockerfile.j2
+++ b/docker/grafana/Dockerfile.j2
@@ -36,7 +36,7 @@ RUN grafana-cli plugins install gnocchixyz-gnocchi-datasource \
 
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_grafana_sudoers \
-    && chmod 755 /usr/local/bin/kolla_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block grafana_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/hacluster/hacluster-base/Dockerfile.j2 b/docker/hacluster/hacluster-base/Dockerfile.j2
index 6dfbc822e..b85d5f824 100644
--- a/docker/hacluster/hacluster-base/Dockerfile.j2
+++ b/docker/hacluster/hacluster-base/Dockerfile.j2
@@ -11,6 +11,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block hacluster_base_footer %}{% endblock %}
diff --git a/docker/heat/heat-base/Dockerfile.j2 b/docker/heat/heat-base/Dockerfile.j2
index bb26cf0c4..ba4afaec3 100644
--- a/docker/heat/heat-base/Dockerfile.j2
+++ b/docker/heat/heat-base/Dockerfile.j2
@@ -30,6 +30,6 @@ RUN ln -s heat-base-source/* heat \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_heat_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_heat_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_heat_extend_start
 
 {% block heat_base_footer %}{% endblock %}
diff --git a/docker/horizon/Dockerfile.j2 b/docker/horizon/Dockerfile.j2
index 5d97d6f94..f66b020d0 100644
--- a/docker/horizon/Dockerfile.j2
+++ b/docker/horizon/Dockerfile.j2
@@ -61,7 +61,7 @@ RUN ln -s horizon-source/* horizon \
     && chown -R horizon: /etc/openstack-dashboard
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block horizon_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/influxdb/Dockerfile.j2 b/docker/influxdb/Dockerfile.j2
index 1b817f2ad..b5028feee 100644
--- a/docker/influxdb/Dockerfile.j2
+++ b/docker/influxdb/Dockerfile.j2
@@ -19,7 +19,7 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_influxdb_sudoers \
-    && chmod 755 /usr/local/bin/kolla_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block influxdb_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/ironic-inspector/Dockerfile.j2 b/docker/ironic-inspector/Dockerfile.j2
index 217dd8d66..ef0a766ec 100644
--- a/docker/ironic-inspector/Dockerfile.j2
+++ b/docker/ironic-inspector/Dockerfile.j2
@@ -36,7 +36,7 @@ RUN chmod 750 /etc/sudoers.d \
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
-RUN chmod 755 /usr/local/bin/kolla_extend_start \
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && mkdir -p /var/lib/ironic-inspector/dhcp-hostsdir \
     && chown -R ironic-inspector: /etc/ironic-inspector /var/lib/ironic-inspector
 
diff --git a/docker/ironic/ironic-base/Dockerfile.j2 b/docker/ironic/ironic-base/Dockerfile.j2
index 41119c37b..8f7f8521e 100644
--- a/docker/ironic/ironic-base/Dockerfile.j2
+++ b/docker/ironic/ironic-base/Dockerfile.j2
@@ -29,7 +29,7 @@ RUN chmod 750 /etc/sudoers.d \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_ironic_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_ironic_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_ironic_extend_start \
     && chown -R ironic: /etc/ironic
 
 {% block ironic_base_footer %}{% endblock %}
diff --git a/docker/iscsid/Dockerfile.j2 b/docker/iscsid/Dockerfile.j2
index 71799e229..ca6e44080 100644
--- a/docker/iscsid/Dockerfile.j2
+++ b/docker/iscsid/Dockerfile.j2
@@ -26,7 +26,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.install_packages(iscsid_packages | customizable("packages"))  }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start \
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && rm /etc/iscsi/initiatorname.iscsi
 
 {% block iscsid_footer %}{% endblock %}
diff --git a/docker/kafka/Dockerfile.j2 b/docker/kafka/Dockerfile.j2
index 8376d72e1..98e6861c2 100644
--- a/docker/kafka/Dockerfile.j2
+++ b/docker/kafka/Dockerfile.j2
@@ -43,7 +43,7 @@ RUN curl -o /tmp/kafka.tgz ${kafka_url} \
 {% endblock %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block kafka_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/keepalived/Dockerfile.j2 b/docker/keepalived/Dockerfile.j2
index c2db99fe2..18a7de835 100644
--- a/docker/keepalived/Dockerfile.j2
+++ b/docker/keepalived/Dockerfile.j2
@@ -22,7 +22,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 COPY check_alive.sh /
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start /check_alive.sh
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /check_alive.sh
 
 {% block keepalived_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/keystone/keystone-fernet/Dockerfile.j2 b/docker/keystone/keystone-fernet/Dockerfile.j2
index 702e064a9..edc2f8d1a 100644
--- a/docker/keystone/keystone-fernet/Dockerfile.j2
+++ b/docker/keystone/keystone-fernet/Dockerfile.j2
@@ -25,7 +25,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 COPY fetch_fernet_tokens.py /usr/bin/
 COPY keystone_bootstrap.sh /usr/local/bin/kolla_keystone_bootstrap
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_keystone_bootstrap /usr/bin/fetch_fernet_tokens.py
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_keystone_bootstrap /usr/bin/fetch_fernet_tokens.py
 
 {% block keystone_fernet_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/keystone/keystone-ssh/Dockerfile.j2 b/docker/keystone/keystone-ssh/Dockerfile.j2
index 770832991..f9bc63f50 100644
--- a/docker/keystone/keystone-ssh/Dockerfile.j2
+++ b/docker/keystone/keystone-ssh/Dockerfile.j2
@@ -34,7 +34,7 @@ RUN mkdir -p /var/run/sshd \
 RUN sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block keystone_ssh_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/keystone/keystone/Dockerfile.j2 b/docker/keystone/keystone/Dockerfile.j2
index 3c8df2e75..eee036be3 100644
--- a/docker/keystone/keystone/Dockerfile.j2
+++ b/docker/keystone/keystone/Dockerfile.j2
@@ -9,7 +9,8 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 COPY keystone_bootstrap.sh /usr/local/bin/kolla_keystone_bootstrap
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_keystone_bootstrap
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
+    && chmod 755 /usr/local/bin/kolla_keystone_bootstrap
 
 {% if base_package_type == 'rpm' %}
     {% set keystone_packages = [
diff --git a/docker/kibana/Dockerfile.j2 b/docker/kibana/Dockerfile.j2
index 2ce191903..11b2bdfcf 100644
--- a/docker/kibana/Dockerfile.j2
+++ b/docker/kibana/Dockerfile.j2
@@ -29,7 +29,7 @@ RUN dpkg --add-architecture amd64 && \
 {% endif %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block kibana_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/kolla-toolbox/Dockerfile.j2 b/docker/kolla-toolbox/Dockerfile.j2
index 9e2a06f2f..630464658 100644
--- a/docker/kolla-toolbox/Dockerfile.j2
+++ b/docker/kolla-toolbox/Dockerfile.j2
@@ -102,6 +102,7 @@ COPY ansible_sudoers /etc/sudoers.d/kolla_ansible_sudoers
 RUN chmod 440 /etc/sudoers.d/kolla_ansible_sudoers
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block kolla_toolbox_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/kuryr/kuryr-base/Dockerfile.j2 b/docker/kuryr/kuryr-base/Dockerfile.j2
index 64baa348b..69b114692 100644
--- a/docker/kuryr/kuryr-base/Dockerfile.j2
+++ b/docker/kuryr/kuryr-base/Dockerfile.j2
@@ -24,6 +24,6 @@ RUN ln -s kuryr-base-source/* kuryr-base \
     && chown -R kuryr: /etc/kuryr
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block kuryr_base_footer %}{% endblock %}
diff --git a/docker/letsencrypt/Dockerfile.j2 b/docker/letsencrypt/Dockerfile.j2
index 8e245b480..b344c6734 100644
--- a/docker/letsencrypt/Dockerfile.j2
+++ b/docker/letsencrypt/Dockerfile.j2
@@ -23,7 +23,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
 
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block letsencrypt_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/logstash/Dockerfile.j2 b/docker/logstash/Dockerfile.j2
index ab6ddfc18..6e4aada54 100644
--- a/docker/logstash/Dockerfile.j2
+++ b/docker/logstash/Dockerfile.j2
@@ -37,7 +37,7 @@ ENV JAVA_HOME /usr/lib/jvm/java-11-openjdk-{{debian_arch}}/
 {{ macros.install_packages(logstash_packages | customizable("packages")) }}
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block logstash_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/magnum/magnum-base/Dockerfile.j2 b/docker/magnum/magnum-base/Dockerfile.j2
index 8b0ebe23e..4aaa3ea2f 100644
--- a/docker/magnum/magnum-base/Dockerfile.j2
+++ b/docker/magnum/magnum-base/Dockerfile.j2
@@ -25,6 +25,6 @@ RUN ln -s magnum-base-source/* magnum \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_magnum_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_magnum_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_magnum_extend_start
 
 {% block magnum_base_footer %}{% endblock %}
diff --git a/docker/manila/manila-base/Dockerfile.j2 b/docker/manila/manila-base/Dockerfile.j2
index fe52c6d67..ebaf09fce 100644
--- a/docker/manila/manila-base/Dockerfile.j2
+++ b/docker/manila/manila-base/Dockerfile.j2
@@ -41,6 +41,6 @@ COPY manila_sudoers /etc/sudoers.d/kolla_manila_sudoers
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_manila_sudoers \
     && touch /usr/local/bin/kolla_manila_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_manila_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_manila_extend_start
 
 {% block manila_base_footer %}{% endblock %}
diff --git a/docker/mariadb/mariadb-server/Dockerfile.j2 b/docker/mariadb/mariadb-server/Dockerfile.j2
index 1a25fc4c0..5418158f6 100644
--- a/docker/mariadb/mariadb-server/Dockerfile.j2
+++ b/docker/mariadb/mariadb-server/Dockerfile.j2
@@ -39,7 +39,7 @@ RUN ln -s /usr/lib64/galera-4 /usr/lib64/galera
 COPY mariadb_sudoers /etc/sudoers.d/kolla_mariadb_sudoers
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 COPY security_reset.expect /usr/local/bin/kolla_security_reset
-RUN chmod 755 /usr/local/bin/kolla_extend_start \
+RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && chmod 755 /usr/local/bin/kolla_security_reset \
     && chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_mariadb_sudoers \
diff --git a/docker/masakari/masakari-base/Dockerfile.j2 b/docker/masakari/masakari-base/Dockerfile.j2
index 5475306c0..0388c47ae 100644
--- a/docker/masakari/masakari-base/Dockerfile.j2
+++ b/docker/masakari/masakari-base/Dockerfile.j2
@@ -41,6 +41,6 @@ RUN ln -s masakari-base-source/* masakari \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_masakari_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_masakari_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_masakari_extend_start
 
 {% block masakari_base_footer %}{% endblock %}
diff --git a/docker/mistral/mistral-base/Dockerfile.j2 b/docker/mistral/mistral-base/Dockerfile.j2
index dd48bd4b7..f74463f7d 100644
--- a/docker/mistral/mistral-base/Dockerfile.j2
+++ b/docker/mistral/mistral-base/Dockerfile.j2
@@ -33,6 +33,6 @@ RUN ln -s mistral-base-source/* mistral \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_mistral_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_mistral_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_mistral_extend_start
 
 {% block mistral_base_footer %}{% endblock %}
diff --git a/docker/monasca/monasca-base/Dockerfile.j2 b/docker/monasca/monasca-base/Dockerfile.j2
index 2ce6aed36..3c35ab4b2 100644
--- a/docker/monasca/monasca-base/Dockerfile.j2
+++ b/docker/monasca/monasca-base/Dockerfile.j2
@@ -34,6 +34,6 @@ RUN {{ macros.install_pip(monasca_base_pip_packages | customizable("pip_packages
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_monasca_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_monasca_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_monasca_extend_start
 
 {% block monasca_base_footer %}{% endblock %}
diff --git a/docker/monasca/monasca-thresh/Dockerfile.j2 b/docker/monasca/monasca-thresh/Dockerfile.j2
index 012a12302..0eda96aee 100644
--- a/docker/monasca/monasca-thresh/Dockerfile.j2
+++ b/docker/monasca/monasca-thresh/Dockerfile.j2
@@ -61,7 +61,7 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 COPY topology_bootstrap.sh /usr/local/bin/topology_bootstrap
 
 RUN touch /usr/local/bin/kolla_monasca_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start \
+    && chmod 644 /usr/local/bin/kolla_extend_start \
     /usr/local/bin/kolla_monasca_extend_start \
     /usr/local/bin/topology_bootstrap
 
diff --git a/docker/murano/murano-base/Dockerfile.j2 b/docker/murano/murano-base/Dockerfile.j2
index f09fb2f2b..861553796 100644
--- a/docker/murano/murano-base/Dockerfile.j2
+++ b/docker/murano/murano-base/Dockerfile.j2
@@ -28,6 +28,6 @@ RUN ln -s murano-base-source/* murano \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_murano_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_murano_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_murano_extend_start
 
 {% block murano_base_footer %}{% endblock %}
diff --git a/docker/neutron/neutron-base/Dockerfile.j2 b/docker/neutron/neutron-base/Dockerfile.j2
index 3c07fa500..ba7cf5ff2 100644
--- a/docker/neutron/neutron-base/Dockerfile.j2
+++ b/docker/neutron/neutron-base/Dockerfile.j2
@@ -87,6 +87,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_neutron_sudoers \
     && touch /usr/local/bin/kolla_neutron_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_neutron_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_neutron_extend_start
 
 {% block neutron_base_footer %}{% endblock %}
diff --git a/docker/nova/nova-base/Dockerfile.j2 b/docker/nova/nova-base/Dockerfile.j2
index 712d6ada9..b860481fc 100644
--- a/docker/nova/nova-base/Dockerfile.j2
+++ b/docker/nova/nova-base/Dockerfile.j2
@@ -80,6 +80,6 @@ RUN chmod 750 /etc/sudoers.d \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_nova_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_nova_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_nova_extend_start
 
 {% block nova_base_footer %}{% endblock %}
diff --git a/docker/nova/nova-libvirt/Dockerfile.j2 b/docker/nova/nova-libvirt/Dockerfile.j2
index 3324175ba..199707b69 100644
--- a/docker/nova/nova-libvirt/Dockerfile.j2
+++ b/docker/nova/nova-libvirt/Dockerfile.j2
@@ -96,7 +96,7 @@ RUN rm -f /etc/libvirt/qemu/networks/default.xml /etc/libvirt/qemu/networks/auto
 {% endif %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block nova_libvirt_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/nova/nova-ssh/Dockerfile.j2 b/docker/nova/nova-ssh/Dockerfile.j2
index 4810393f6..8fd6b2447 100644
--- a/docker/nova/nova-ssh/Dockerfile.j2
+++ b/docker/nova/nova-ssh/Dockerfile.j2
@@ -31,7 +31,7 @@ RUN mkdir -p /var/run/sshd \
 RUN sed -ri 's/session(\s+)required(\s+)pam_loginuid.so/session\1optional\2pam_loginuid.so/' /etc/pam.d/sshd
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block nova_ssh_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/octavia/octavia-base/Dockerfile.j2 b/docker/octavia/octavia-base/Dockerfile.j2
index a1d28846d..010326531 100644
--- a/docker/octavia/octavia-base/Dockerfile.j2
+++ b/docker/octavia/octavia-base/Dockerfile.j2
@@ -31,6 +31,6 @@ RUN ln -s /octavia-base-source/* octavia \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_octavia_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_octavia_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_octavia_extend_start
 
 {% block octavia_base_footer %}{% endblock %}
diff --git a/docker/openvswitch/openvswitch-base/Dockerfile.j2 b/docker/openvswitch/openvswitch-base/Dockerfile.j2
index a2d708014..5ae3dc15b 100644
--- a/docker/openvswitch/openvswitch-base/Dockerfile.j2
+++ b/docker/openvswitch/openvswitch-base/Dockerfile.j2
@@ -37,6 +37,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 # NOTE(hrw): Upstream moved tcpdump to /usr/bin/ in 4.99 version (used in Debian)
 RUN if [ -e /usr/sbin/tcpdump ]; then mv /usr/sbin/tcpdump /usr/bin/tcpdump; fi \
     && touch /usr/local/bin/kolla_openvswitch_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_openvswitch_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_openvswitch_extend_start
 
 {% block openvswitch_base_footer %}{% endblock %}
diff --git a/docker/ovn/ovn-base/Dockerfile.j2 b/docker/ovn/ovn-base/Dockerfile.j2
index 613b16765..247eab83a 100644
--- a/docker/ovn/ovn-base/Dockerfile.j2
+++ b/docker/ovn/ovn-base/Dockerfile.j2
@@ -22,6 +22,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block ovn_base_footer %}{% endblock %}
diff --git a/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 b/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
index 0ea430e4f..1eb6672b0 100644
--- a/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
+++ b/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
@@ -32,6 +32,6 @@ RUN update-alternatives --set ovs-vswitchd /usr/lib/openvswitch-switch-dpdk/ovs-
 {% endblock %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block ovsdpdk_footer %}{% endblock %}
diff --git a/docker/placement/placement-base/Dockerfile.j2 b/docker/placement/placement-base/Dockerfile.j2
index b2230f0f4..cc6ccc2af 100644
--- a/docker/placement/placement-base/Dockerfile.j2
+++ b/docker/placement/placement-base/Dockerfile.j2
@@ -39,6 +39,6 @@ RUN ln -s placement-base-source/* placement \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_placement_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_placement_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_placement_extend_start
 
 {% block placement_base_footer %}{% endblock %}
diff --git a/docker/prometheus/prometheus-base/Dockerfile.j2 b/docker/prometheus/prometheus-base/Dockerfile.j2
index 3dbe0d0fd..3db16cbfd 100644
--- a/docker/prometheus/prometheus-base/Dockerfile.j2
+++ b/docker/prometheus/prometheus-base/Dockerfile.j2
@@ -10,6 +10,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.configure_user(name='prometheus') }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block prometheus_base_footer %}{% endblock %}
diff --git a/docker/proxysql/Dockerfile.j2 b/docker/proxysql/Dockerfile.j2
index e5427669f..aadfae7b9 100644
--- a/docker/proxysql/Dockerfile.j2
+++ b/docker/proxysql/Dockerfile.j2
@@ -29,7 +29,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 COPY kolla_proxysql_start kolla_proxysql_config_sync kolla_extend_start /usr/local/bin/
 RUN chmod 755 /usr/local/bin/kolla_proxysql_start \
     && chmod 755 /usr/local/bin/kolla_proxysql_config_sync \
-    && chmod 755 /usr/local/bin/kolla_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block proxysql_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/rabbitmq/Dockerfile.j2 b/docker/rabbitmq/Dockerfile.j2
index 270cb96c7..6dd08ef3f 100644
--- a/docker/rabbitmq/Dockerfile.j2
+++ b/docker/rabbitmq/Dockerfile.j2
@@ -57,7 +57,7 @@ RUN chmod 755 /usr/local/bin/healthcheck_rabbitmq
 {% endif %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block rabbitmq_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/redis/redis-base/Dockerfile.j2 b/docker/redis/redis-base/Dockerfile.j2
index 7f758d3fb..0ec30e27e 100644
--- a/docker/redis/redis-base/Dockerfile.j2
+++ b/docker/redis/redis-base/Dockerfile.j2
@@ -10,6 +10,6 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 {{ macros.configure_user(name='redis', homedir='/run/redis') }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block redis_base_footer %}{% endblock %}
diff --git a/docker/sahara/sahara-base/Dockerfile.j2 b/docker/sahara/sahara-base/Dockerfile.j2
index 1204d4a04..fae76be4d 100644
--- a/docker/sahara/sahara-base/Dockerfile.j2
+++ b/docker/sahara/sahara-base/Dockerfile.j2
@@ -42,6 +42,6 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_sahara_sudoers \
     && touch /usr/local/bin/kolla_sahara_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_sahara_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_sahara_extend_start
 
 {% block sahara_base_footer %}{% endblock %}
diff --git a/docker/senlin/senlin-base/Dockerfile.j2 b/docker/senlin/senlin-base/Dockerfile.j2
index 17adf0f4c..69c4934f8 100644
--- a/docker/senlin/senlin-base/Dockerfile.j2
+++ b/docker/senlin/senlin-base/Dockerfile.j2
@@ -24,6 +24,6 @@ RUN ln -s senlin-base-source/* senlin \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_senlin_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_senlin_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_senlin_extend_start
 
 {% block senlin_base_footer %}{% endblock %}
diff --git a/docker/skydive/skydive-base/Dockerfile.j2 b/docker/skydive/skydive-base/Dockerfile.j2
index 22c7f6c7e..4406991a5 100644
--- a/docker/skydive/skydive-base/Dockerfile.j2
+++ b/docker/skydive/skydive-base/Dockerfile.j2
@@ -28,6 +28,6 @@ RUN curl -o /usr/bin/skydive ${skydive_url} \
 {% endblock %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block skydive_base_footer %}{% endblock %}
diff --git a/docker/solum/solum-base/Dockerfile.j2 b/docker/solum/solum-base/Dockerfile.j2
index 050d73d58..11e55d9a9 100644
--- a/docker/solum/solum-base/Dockerfile.j2
+++ b/docker/solum/solum-base/Dockerfile.j2
@@ -24,6 +24,6 @@ RUN ln -s solum-base-source/* solum \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_solum_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_solum_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_solum_extend_start
 
 {% block solum_base_footer %}{% endblock %}
diff --git a/docker/storm/storm-base/Dockerfile.j2 b/docker/storm/storm-base/Dockerfile.j2
index 272f6a9db..706b8fd06 100644
--- a/docker/storm/storm-base/Dockerfile.j2
+++ b/docker/storm/storm-base/Dockerfile.j2
@@ -53,6 +53,6 @@ ENV PYTHON='/usr/bin/python3'
 {% endblock %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block storm_base_footer %}{% endblock %}
diff --git a/docker/swift/swift-rsyncd/Dockerfile.j2 b/docker/swift/swift-rsyncd/Dockerfile.j2
index b46e5e4cf..854c99cd4 100644
--- a/docker/swift/swift-rsyncd/Dockerfile.j2
+++ b/docker/swift/swift-rsyncd/Dockerfile.j2
@@ -15,7 +15,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build
 
 {{ macros.install_packages(swift_rsyncd_packages | customizable("packages")) }}
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block swift_rsyncd_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/tacker/tacker-base/Dockerfile.j2 b/docker/tacker/tacker-base/Dockerfile.j2
index b728b16da..bce2af931 100644
--- a/docker/tacker/tacker-base/Dockerfile.j2
+++ b/docker/tacker/tacker-base/Dockerfile.j2
@@ -33,6 +33,6 @@ RUN ln -s tacker-base-source/* tacker \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_tacker_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_tacker_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_tacker_extend_start
 
 {% block tacker_base_footer %}{% endblock %}
diff --git a/docker/telegraf/Dockerfile.j2 b/docker/telegraf/Dockerfile.j2
index 0a3382449..dd5fd2d8b 100644
--- a/docker/telegraf/Dockerfile.j2
+++ b/docker/telegraf/Dockerfile.j2
@@ -34,7 +34,7 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN chmod 750 /etc/sudoers.d \
     && chmod 440 /etc/sudoers.d/kolla_telegraf_sudoers \
-    && chmod 755 /usr/local/bin/kolla_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block telegraf_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/trove/trove-base/Dockerfile.j2 b/docker/trove/trove-base/Dockerfile.j2
index 5dadfe53f..92baa5640 100644
--- a/docker/trove/trove-base/Dockerfile.j2
+++ b/docker/trove/trove-base/Dockerfile.j2
@@ -24,6 +24,6 @@ RUN ln -s trove-base-source/* trove \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_trove_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_trove_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_trove_extend_start
 
 {% block trove_base_footer %}{% endblock %}
diff --git a/docker/venus/venus-base/Dockerfile.j2 b/docker/venus/venus-base/Dockerfile.j2
index 9f95a4963..1b192d401 100644
--- a/docker/venus/venus-base/Dockerfile.j2
+++ b/docker/venus/venus-base/Dockerfile.j2
@@ -24,6 +24,6 @@ RUN ln -s venus-base-source/* venus \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_venus_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_venus_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_venus_extend_start
 
 {% block venus_base_footer %}{% endblock %}
diff --git a/docker/vitrage/vitrage-base/Dockerfile.j2 b/docker/vitrage/vitrage-base/Dockerfile.j2
index 79fa8f770..2e4b14e52 100644
--- a/docker/vitrage/vitrage-base/Dockerfile.j2
+++ b/docker/vitrage/vitrage-base/Dockerfile.j2
@@ -37,6 +37,6 @@ RUN ln -s vitrage-base-source/* vitrage \
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN touch /usr/local/bin/kolla_vitrage_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_vitrage_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_vitrage_extend_start
 
 {% block vitrage_base_footer %}{% endblock %}
diff --git a/docker/watcher/watcher-base/Dockerfile.j2 b/docker/watcher/watcher-base/Dockerfile.j2
index 67c180715..c4feea2bc 100644
--- a/docker/watcher/watcher-base/Dockerfile.j2
+++ b/docker/watcher/watcher-base/Dockerfile.j2
@@ -25,6 +25,6 @@ RUN ln -s watcher-base-source/* watcher \
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
 
 RUN touch /usr/local/bin/kolla_watcher_extend_start \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_watcher_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_watcher_extend_start
 
 {% block watcher_base_footer %}{% endblock %}
diff --git a/docker/zookeeper/Dockerfile.j2 b/docker/zookeeper/Dockerfile.j2
index f0a02d433..cb6a05b83 100644
--- a/docker/zookeeper/Dockerfile.j2
+++ b/docker/zookeeper/Dockerfile.j2
@@ -35,7 +35,7 @@ RUN curl -o /tmp/zookeeper.tar.gz ${zookeeper_url} \
 {% endblock %}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-RUN chmod 755 /usr/local/bin/kolla_extend_start
+RUN chmod 644 /usr/local/bin/kolla_extend_start
 
 {% block zookeeper_footer %}{% endblock %}
 {% block footer %}{% endblock %}
diff --git a/docker/zun/zun-base/Dockerfile.j2 b/docker/zun/zun-base/Dockerfile.j2
index 9e1c4f07c..e8dd808da 100644
--- a/docker/zun/zun-base/Dockerfile.j2
+++ b/docker/zun/zun-base/Dockerfile.j2
@@ -50,6 +50,6 @@ RUN chmod 750 /etc/sudoers.d \
     && chmod 640 /etc/sudoers.d/kolla_zun_sudoers \
     && touch /usr/local/bin/kolla_zun_extend_start \
     && chmod 755 /var/www/cgi-bin/zun \
-    && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_zun_extend_start
+    && chmod 644 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_zun_extend_start
 
 {% block zun_base_footer %}{% endblock %}