51 lines
1.9 KiB
Bash
51 lines
1.9 KiB
Bash
|
#!/usr/bin/bash
|
||
|
|
|
||
|
|
NONROOT_UID=10475
|
||
|
|
NONROOT_GID=10475
|
||
|
|
USER="ironic-suse"
|
||
|
|
|
||
|
|
groupadd -r -g ${NONROOT_GID} ${USER}
|
||
|
|
useradd -r -g ${NONROOT_GID} \
|
||
|
|
-u ${NONROOT_UID} \
|
||
|
|
-d /var/lib/ironic \
|
||
|
|
-s /sbin/nologin \
|
||
|
|
${USER}
|
||
|
|
|
||
|
|
# create ironic's http_root directory
|
||
|
|
mkdir -p /shared/html
|
||
|
|
chown "${NONROOT_UID}":"${NONROOT_GID}" /shared/html
|
||
|
|
|
||
|
|
# we'll bind mount shared ca and ironic/inspector certificate dirs here
|
||
|
|
# that need to have correct ownership as the entire ironic in BMO
|
||
|
|
# deployment shares a single fsGroup in manifest's securityContext
|
||
|
|
mkdir -p /certs/ca
|
||
|
|
chown "${NONROOT_UID}":"${NONROOT_GID}" /certs{,/ca}
|
||
|
|
chmod 2775 /certs{,/ca}
|
||
|
|
|
||
|
|
# apache2 permission changes
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/apache2
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /run
|
||
|
|
|
||
|
|
# ironic, inspector and httpd related changes
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/ironic /etc/httpd /etc/httpd
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/ironic-inspector
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/log
|
||
|
|
chmod 2775 /etc/ironic /etc/ironic-inspector /etc/httpd/conf /etc/httpd/conf.d
|
||
|
|
chmod 664 /etc/ironic/* /etc/ironic-inspector/* /etc/httpd/conf/* /etc/httpd/conf.d/*
|
||
|
|
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/lib/ironic
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/lib/ironic-inspector
|
||
|
|
chmod 2775 /var/lib/ironic /var/lib/ironic-inspector
|
||
|
|
chmod 664 /var/lib/ironic/ironic.db /var/lib/ironic-inspector/ironic-inspector.db
|
||
|
|
|
||
|
|
# dnsmasq, and the capabilities required to run it as non-root user
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/dnsmasq.conf /var/lib/dnsmasq
|
||
|
|
chmod 2775 /var/lib/dnsmasq
|
||
|
|
touch /var/lib/dnsmasq/dnsmasq.leases
|
||
|
|
chmod 664 /etc/dnsmasq.conf /var/lib/dnsmasq/dnsmasq.leases
|
||
|
|
|
||
|
|
# ca-certificates permission changes
|
||
|
|
touch /var/lib/ca-certificates/ca-bundle.pem.new
|
||
|
|
chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/lib/ca-certificates/
|
||
|
|
chmod -R +w /var/lib/ca-certificates/
|