Fix bug 1709 - Adding non-root user to run Keystone

Change-Id: I2a9dadb36039fa3b2e61c8c055a4f86e5c3fd172
Signed-off-by: sousaedu <eduardo.sousa@canonical.com>

diff --git a/docker/Keystone/Dockerfile b/docker/Keystone/Dockerfile
index 9c0dc1e..a608f87 100644 (file)
--- a/docker/Keystone/Dockerfile
+++ b/docker/Keystone/Dockerfile
@@ -24,9 +24,9 @@ RUN if [ ! -z $APT_PROXY ] ; then \
 
 EXPOSE 5000
 
-WORKDIR /keystone
+WORKDIR /app
 
-COPY scripts/start.sh /keystone/start.sh
+COPY scripts/start.sh /app/start.sh
 
 RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
@@ -60,6 +60,31 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update && \
 RUN pip3 install -U pip==21.3.1 && \
     pip3 install python-ldap==3.2.0 ldappool==3.0.0 python-openstackclient==5.7.0
 
+# Creating the user for the app
+RUN groupadd -g 1000 appuser && \
+    useradd -u 1000 -g 1000 -d /app appuser && \
+    usermod -a -G keystone appuser && \
+    usermod -a -G adm appuser && \
+    chown -R appuser:appuser /app && \
+    chown root:keystone /etc/keystone && \
+    chmod 770 /etc/keystone && \
+    chown root:keystone /etc/ssl/certs && \
+    chmod 770 /etc/ssl/certs && \
+    chown root:keystone /etc/apache2/apache2.conf && \
+    chmod 664 /etc/apache2/apache2.conf && \
+    sed -i 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf && \
+    chown root:keystone /var/spool && \
+    chmod 775 /var/spool && \
+    chmod 770 /var/log/apache2 && \
+    chmod 660 /var/log/apache2/* && \
+    chmod 770 /var/log/keystone && \
+    chown root:keystone /var/run/apache2 && \
+    chmod 775 /var/run/apache2 && \
+    mkdir -p /etc/sudoers.d && \
+    echo "%appuser ALL= NOPASSWD: /sbin/service apache2 *" > /etc/sudoers.d/appuser
+
+USER appuser
+
 # database
 ENV DB_HOST                 keystone-db
 ENV DB_PORT                 3306

diff --git a/docker/Keystone/scripts/start.sh b/docker/Keystone/scripts/start.sh
index 66b3830..d7fa2ab 100755 (executable)
--- a/docker/Keystone/scripts/start.sh
+++ b/docker/Keystone/scripts/start.sh
@@ -89,7 +89,7 @@ function is_user_db_created() {
         echo "DB User $db_name exists"
         return 0
     else
-        echo "DB User$db_name does not exist"
+        echo "DB User $db_name does not exist"
         return 1
     fi
 }
@@ -209,7 +209,7 @@ fi
 
 # Populate Keystone database
 if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
-    su -s /bin/sh -c "keystone-manage db_sync" keystone
+    keystone-manage db_sync
 fi
 
 # Initialize Fernet key repositories
@@ -231,6 +231,7 @@ if [ -z $DB_EXISTS ] || [ -z $DB_NOT_EMPTY ]; then
 fi
 
 echo "ServerName $KEYSTONE_HOST" >> /etc/apache2/apache2.conf
+
 # Restart Apache Service
 service apache2 restart