From 81ae2482c636f13b09f963196c15d681a8ddee8b Mon Sep 17 00:00:00 2001
From: sousaedu <eduardo.sousa@canonical.com>
Date: Fri, 21 Jan 2022 14:01:53 +0000
Subject: [PATCH] Fix bug 1709 - Adding non-root user to run Keystone
Change-Id: I2a9dadb36039fa3b2e61c8c055a4f86e5c3fd172
Signed-off-by: sousaedu <eduardo.sousa@canonical.com>
(cherry picked from commit 9d1d0c13292004487f57c7fd1ed8fb23d604725a)
---
docker/Keystone/Dockerfile | 29 +++++++++++++++++++++++++++--
docker/Keystone/scripts/start.sh | 5 +++--
2 files changed, 30 insertions(+), 4 deletions(-)
diff --git a/docker/Keystone/Dockerfile b/docker/Keystone/Dockerfile
index e81a7b57..95738fd0 100644
--- a/docker/Keystone/Dockerfile
+++ b/docker/Keystone/Dockerfile
@@ -20,9 +20,9 @@ FROM ubuntu:20.04
EXPOSE 5000
-WORKDIR /keystone
+WORKDIR /app
-COPY scripts/start.sh /keystone/start.sh
+COPY scripts/start.sh /app/start.sh
RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
@@ -56,6 +56,31 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
RUN pip3 install -U pip==21.3.1 && \
pip3 install python-ldap==3.2.0 ldappool==3.0.0 python-openstackclient==5.7.0
+# Creating the user for the app
+RUN groupadd -g 1000 appuser && \
+ useradd -u 1000 -g 1000 -d /app appuser && \
+ usermod -a -G keystone appuser && \
+ usermod -a -G adm appuser && \
+ chown -R appuser:appuser /app && \
+ chown root:keystone /etc/keystone && \
+ chmod 770 /etc/keystone && \
+ chown root:keystone /etc/ssl/certs && \
+ chmod 770 /etc/ssl/certs && \
+ chown root:keystone /etc/apache2/apache2.conf && \
+ chmod 664 /etc/apache2/apache2.conf && \
+ sed -i 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf && \
+ chown root:keystone /var/spool && \
+ chmod 775 /var/spool && \
+ chmod 770 /var/log/apache2 && \
+ chmod 660 /var/log/apache2/* && \
+ chmod 770 /var/log/keystone && \
+ chown root:keystone /var/run/apache2 && \
+ chmod 775 /var/run/apache2 && \
+ mkdir -p /etc/sudoers.d && \
+ echo "%appuser ALL= NOPASSWD: /sbin/service apache2 *" > /etc/sudoers.d/appuser
+
+USER appuser
+
# database
ENV DB_HOST keystone-db
ENV DB_PORT 3306
diff --git a/docker/Keystone/scripts/start.sh b/docker/Keystone/scripts/start.sh
index 66b3830a..d7fa2abd 100755
--- a/docker/Keystone/scripts/start.sh
+++ b/docker/Keystone/scripts/start.sh
@@ -89,7 +89,7 @@ function is_user_db_created() {
echo "DB User $db_name exists"
return 0
else
- echo "DB User$db_name does not exist"
+ echo "DB User $db_name does not exist"
return 1
fi
}
@@ -209,7 +209,7 @@ fi
# Populate Keystone database
if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
- su -s /bin/sh -c "keystone-manage db_sync" keystone
+ keystone-manage db_sync
fi
# Initialize Fernet key repositories
@@ -231,6 +231,7 @@ if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
fi
echo "ServerName $KEYSTONE_HOST" >> /etc/apache2/apache2.conf
+
# Restart Apache Service
service apache2 restart
--
GitLab