diff options
| author | Jenkins <jenkins@review.openstack.org> | 2015-11-13 07:53:06 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2015-11-13 07:53:06 +0000 |
| commit | 52bd56e6868fddfcce2e402e828e4b998bbd60ad (patch) | |
| tree | e10770e6c94f1a15c7024f171f26b94484e0f3a2 /docker | |
| parent | ea9d5cd067d379344122d98615df39ef9b4d266d (diff) | |
| parent | 22def41d37d8046541b25fca1fe806090bf14638 (diff) | |
| download | kolla-52bd56e6868fddfcce2e402e828e4b998bbd60ad.tar.gz kolla-52bd56e6868fddfcce2e402e828e4b998bbd60ad.zip | |
Merge "Drop root privileges for rabbitmq"
Diffstat (limited to 'docker')
| -rw-r--r-- | docker/rabbitmq/Dockerfile.j2 | 8 | ||||
| -rw-r--r-- | docker/rabbitmq/extend_start.sh | 2 | ||||
| -rw-r--r-- | docker/rabbitmq/rabbitmq_sudoers | 1 |
3 files changed, 9 insertions, 2 deletions
diff --git a/docker/rabbitmq/Dockerfile.j2 b/docker/rabbitmq/Dockerfile.j2 index f806f8977..fad8c4e4a 100644 --- a/docker/rabbitmq/Dockerfile.j2 +++ b/docker/rabbitmq/Dockerfile.j2 @@ -28,6 +28,12 @@ RUN /usr/lib/rabbitmq/bin/rabbitmq-plugins enable --offline \ && /bin/true COPY extend_start.sh /usr/local/bin/kolla_extend_start -RUN chmod 755 /usr/local/bin/kolla_extend_start +COPY rabbitmq_sudoers /etc/sudoers.d/rabbitmq_sudoers +RUN chmod 755 /usr/local/bin/kolla_extend_start \ + && chmod 750 /etc/sudoers.d \ + && chmod 440 /etc/sudoers.d/rabbitmq_sudoers \ + && usermod -a -G kolla rabbitmq {{ include_footer }} + +USER rabbitmq
\ No newline at end of file diff --git a/docker/rabbitmq/extend_start.sh b/docker/rabbitmq/extend_start.sh index e1c1007e3..06e71e810 100644 --- a/docker/rabbitmq/extend_start.sh +++ b/docker/rabbitmq/extend_start.sh @@ -3,8 +3,8 @@ # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases # of the KOLLA_BOOTSTRAP variable being set, including empty. if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then + sudo chown -R rabbitmq: /var/lib/rabbitmq echo "${RABBITMQ_CLUSTER_COOKIE}" > /var/lib/rabbitmq/.erlang.cookie - chown -R rabbitmq: /var/lib/rabbitmq chmod 400 /var/lib/rabbitmq/.erlang.cookie exit 0 fi diff --git a/docker/rabbitmq/rabbitmq_sudoers b/docker/rabbitmq/rabbitmq_sudoers new file mode 100644 index 000000000..7d3d091d8 --- /dev/null +++ b/docker/rabbitmq/rabbitmq_sudoers @@ -0,0 +1 @@ +%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R rabbitmq\: /var/lib/rabbitmq, /bin/chown -R rabbitmq\: /var/lib/rabbitmq |