forked from suse-edge/Factory
Marco Chiappero
62f9faf144
Try to reuse as much as possible of the upstream configure-nonroot.sh Co-authored-by: Nicolas Belouin <nicolas.belouin@suse.com> Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
71 lines
2.6 KiB
Bash
Executable File
71 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/bash
|
|
|
|
# This script changes permissions to allow Ironic container to run as non-root
|
|
# user. As the same image is used to run ironic, ironic-httpd, ironic-dsnmasq,
|
|
# and ironic-log-watch via BMO's ironic k8s manifest, it has
|
|
# to be configured to work with multiple different users and groups, while they
|
|
# share files via bind mounts (/shared, /certs/*), which can only get one
|
|
# group id as "fsGroup". Additionally, dnsmasq needs three capabilities to run
|
|
# which we provide via "setcap", and "allowPrivilegeEscalation: true" in
|
|
# manifest.
|
|
|
|
set -eux
|
|
|
|
# user and group are from ironic rpms (uid 997, gid 994)
|
|
NONROOT_UID=10475
|
|
NONROOT_GID=10475
|
|
IRONIC_USER="ironic-suse"
|
|
IRONIC_GROUP="ironic-suse"
|
|
|
|
groupadd -r -g ${NONROOT_GID} ${IRONIC_GROUP}
|
|
useradd -r -g ${NONROOT_GID} \
|
|
-u ${NONROOT_UID} \
|
|
-d /var/lib/ironic \
|
|
-s /sbin/nologin \
|
|
${IRONIC_USER}
|
|
|
|
# most containers mount /shared but dnsmasq can live without it
|
|
mkdir -p /shared
|
|
mkdir -p /data
|
|
mkdir -p /conf
|
|
chown "${IRONIC_USER}":"${IRONIC_GROUP}" /shared
|
|
chown "${IRONIC_USER}":"${IRONIC_GROUP}" /data
|
|
chown "${IRONIC_USER}":"${IRONIC_GROUP}" /conf
|
|
|
|
# we'll bind mount shared ca and ironic certificate dirs here
|
|
# that need to have correct ownership as the entire ironic in BMO
|
|
# deployment shares a single fsGroup in manifest's securityContext
|
|
mkdir -p /certs/ca
|
|
chown "${IRONIC_USER}":"${IRONIC_GROUP}" /certs{,/ca}
|
|
chmod 2775 /certs{,/ca}
|
|
|
|
# apache2 permission changes
|
|
chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/apache2
|
|
chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /run
|
|
|
|
# ironic and httpd related changes
|
|
mkdir -p /etc/httpd/conf.d
|
|
chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/ironic /etc/httpd/conf /etc/httpd/conf.d
|
|
chmod 2775 /etc/ironic /etc/httpd/conf /etc/httpd/conf.d
|
|
#chmod 664 /etc/ironic/* /etc/httpd/conf/* /etc/httpd/conf.d/*
|
|
chmod 664 /etc/ironic/* /etc/httpd/conf/*
|
|
|
|
chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /var/lib/ironic
|
|
chmod 2775 /var/lib/ironic
|
|
chmod 664 /var/lib/ironic/ironic.sqlite
|
|
|
|
# dnsmasq, and the capabilities required to run it as non-root user
|
|
chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/dnsmasq.conf
|
|
#handled at chart level
|
|
#setcap "cap_net_raw,cap_net_admin,cap_net_bind_service=+eip" /usr/sbin/dnsmasq
|
|
|
|
# ca-certificates permission changes
|
|
touch /var/lib/ca-certificates/ca-bundle.pem.new
|
|
chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /var/lib/ca-certificates/
|
|
chmod -R +w /var/lib/ca-certificates/
|
|
|
|
# probes that are created before start
|
|
touch /bin/ironic-{readi,live}ness
|
|
chown root:"${IRONIC_GROUP}" /bin/ironic-{readi,live}ness
|
|
chmod 775 /bin/ironic-{readi,live}ness
|