From 6cf5928ff1ee2f9d21662d74057f3a8331ddedfb Mon Sep 17 00:00:00 2001 From: Steven Dake Date: Sun, 8 Nov 2015 16:34:32 -0500 Subject: Base image changes for drop-root The reason we are doing drop root is so that a network exposed software component (i.e. glance) cannot be used to affect the immutability of the container which it runs in. I have tried several different approaches and this is the only approach which puts glance in PID=1 while ensuring no files may be written by the glance process in the container image except for the log files. Change-Id: Ifd3c8c361b78d0e4791dade3afa6435290407c41 Partially-Implements: blueprint drop-root --- docker/base/sudoers | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 docker/base/sudoers (limited to 'docker/base/sudoers') diff --git a/docker/base/sudoers b/docker/base/sudoers new file mode 100644 index 000000000..0205b920f --- /dev/null +++ b/docker/base/sudoers @@ -0,0 +1,16 @@ +# The idea here is a container service adds their UID to the kolla group +# via usermod -a -G kolla . Then the kolla_start may run +# kolla_set_configs via sudo as the root user which is necessary to protect +# the immutability of the container + +# anyone in the kolla group may sudo -E (set the environment) +Defaults: %kolla setenv + +# root may run any commands via sudo as the network seervice user. This is +# neededfor database migrations of existing services which have not been +# converted to run as a non-root user, but instead do that via sudo -E glance +root ALL=(ALL) ALL + +# anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the +# root user via sudo without password confirmation +%kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs -- cgit v1.2.3