From 4c9e15b94e3f8e27a3ef194768c64357efa9ea82 Mon Sep 17 00:00:00 2001 From: Steven Dake Date: Tue, 10 Nov 2015 04:11:20 -0500 Subject: Drop root privileges for mariadb Drop root privileges for mariadb. This isn't perfect. If somemone breaks out of the container and can run sudo within the contianer, it would be possible to replace the root credentials of the database. Any container that uses sudo suffers from some extra attack vector related to the sudo command. That said, the sudo commands are locked down to minimize harm. Change-Id: I4b3573725d940bb8aa90d43a6235d8cf7d30fc64 Partially-Implements: blueprint drop-root --- docker/base/sudoers | 2 ++ 1 file changed, 2 insertions(+) (limited to 'docker/base') diff --git a/docker/base/sudoers b/docker/base/sudoers index 0205b920f..76baefcb0 100644 --- a/docker/base/sudoers +++ b/docker/base/sudoers @@ -14,3 +14,5 @@ root ALL=(ALL) ALL # anyone in the kolla group may run /usr/local/bin/kolla_set_configs as the # root user via sudo without password confirmation %kolla ALL=(root) NOPASSWD: /usr/local/bin/kolla_set_configs + +#includedir /etc/sudoers.d -- cgit v1.2.3