diff options
| author | Steven Dake <stdake@cisco.com> | 2015-11-10 04:11:20 -0500 |
|---|---|---|
| committer | Steven Dake <stdake@cisco.com> | 2015-11-12 03:12:40 -0500 |
| commit | 4c9e15b94e3f8e27a3ef194768c64357efa9ea82 (patch) | |
| tree | c8f6bcc8b54280a59359e115316069a4a4c75266 /docker | |
| parent | 09e9b1be33b0f0b3ee75f9545e6430877b6e0264 (diff) | |
| download | kolla-4c9e15b94e3f8e27a3ef194768c64357efa9ea82.tar.gz kolla-4c9e15b94e3f8e27a3ef194768c64357efa9ea82.zip | |
Drop root privileges for mariadb
Drop root privileges for mariadb. This isn't perfect. If somemone
breaks out of the container and can run sudo within the contianer,
it would be possible to replace the root credentials of the database.
Any container that uses sudo suffers from some extra attack vector
related to the sudo command. That said, the sudo commands are
locked down to minimize harm.
Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64
Partially-Implements: blueprint drop-root
Diffstat (limited to 'docker')
| -rw-r--r-- | docker/base/sudoers | 2 | ||||
| -rw-r--r-- | docker/mariadb/Dockerfile.j2 | 9 | ||||
| -rw-r--r-- | docker/mariadb/extend_start.sh | 8 | ||||
| -rw-r--r-- | docker/mariadb/mariadb_sudoers | 1 |
4 files changed, 15 insertions, 5 deletions
diff --git a/docker/base/sudoers b/docker/base/sudoers index 0205b920f..76baefcb0 100644 --- a/docker/base/sudoers +++ b/docker/base/sudoers @@ -14,3 +14,5 @@ root ALL=(ALL) ALL # anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the # root user via sudo without password confirmation %kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs + +#includedir /etc/sudoers.d diff --git a/docker/mariadb/Dockerfile.j2 b/docker/mariadb/Dockerfile.j2 index a840d9b8d..d36504894 100644 --- a/docker/mariadb/Dockerfile.j2 +++ b/docker/mariadb/Dockerfile.j2 @@ -28,9 +28,16 @@ RUN apt-get install -y --no-install-recommends \ {% endif %} +COPY mariadb_sudoers /etc/sudoers.d/mariadb_sudoers COPY extend_start.sh /usr/local/bin/kolla_extend_start COPY security_reset.expect /usr/local/bin/kolla_security_reset RUN chmod 755 /usr/local/bin/kolla_extend_start \ - && chmod 755 /usr/local/bin/kolla_security_reset + && chmod 755 /usr/local/bin/kolla_security_reset \ + && chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/mariadb_sudoers \ + && usermod -a -G kolla mysql + + +USER mysql {{ include_footer }} diff --git a/docker/mariadb/extend_start.sh b/docker/mariadb/extend_start.sh index 8a8699b88..2ff24b73b 100644 --- a/docker/mariadb/extend_start.sh +++ b/docker/mariadb/extend_start.sh @@ -5,19 +5,19 @@ function bootstrap_db { # Waiting for deamon sleep 10 - kolla_security_reset + sudo -E kolla_security_reset mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;" mysql -u root --password="${DB_ROOT_PASSWORD}" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DB_ROOT_PASSWORD}' WITH GRANT OPTION;" - mysqladmin -p"${DB_ROOT_PASSWORD}" shutdown + mysqladmin -uroot -p"${DB_ROOT_PASSWORD}" shutdown } -chown mysql: /var/lib/mysql +sudo chown mysql: /var/lib/mysql # This catches all cases of the BOOTSTRAP variable being set, including empty if [[ "${!KOLLA_BOOTSTRAP[@]}" ]] && [[ ! -e /var/lib/mysql/cluster.exists ]]; then ARGS="--wsrep-new-cluster" touch /var/lib/mysql/cluster.exists - mysql_install_db --user=mysql + mysql_install_db bootstrap_db fi diff --git a/docker/mariadb/mariadb_sudoers b/docker/mariadb/mariadb_sudoers new file mode 100644 index 000000000..c95b1e2ad --- /dev/null +++ b/docker/mariadb/mariadb_sudoers @@ -0,0 +1 @@ +%kolla ALL=(root) NOPASSWD: /bin/chown mysql\: /var/lib/mysql, /usr/bin/chown mysql\: /var/lib/mysql, /usr/local/bin/kolla_security_reset |