From b62776733a5cf9a78f8516bc25e22b619f536cb4 Mon Sep 17 00:00:00 2001 From: Jonathan Senecal Date: Fri, 14 Sep 2018 16:22:49 -0400 Subject: [PATCH 1/5] Added fping6 support --- entrypoint.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/entrypoint.sh b/entrypoint.sh index 3067bd5..9a25009 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -143,9 +143,12 @@ cat > ${LIBRENMS_PATH}/config.d/user.php < /usr/bin/fping6 +chmod +x /usr/bin/fping6 cat > ${LIBRENMS_PATH}/config.d/fping.php < Date: Fri, 14 Sep 2018 16:52:38 -0400 Subject: [PATCH 2/5] fping is in sbin --- entrypoint.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 9a25009..9582ab7 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -143,8 +143,8 @@ cat > ${LIBRENMS_PATH}/config.d/user.php < /usr/bin/fping6 -chmod +x /usr/bin/fping6 +echo "/usr/sbin/fping -6 \$@" > /usr/sbin/fping6 +chmod +x /usr/sbin/fping6 cat > ${LIBRENMS_PATH}/config.d/fping.php < Date: Fri, 21 Sep 2018 15:18:19 -0400 Subject: [PATCH 3/5] Add CAP_NET_RAW on fping6 Prevents `validate.php` from complaining. --- entrypoint.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/entrypoint.sh b/entrypoint.sh index c6b99a3..7956499 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -145,6 +145,7 @@ EOL # Config : Fping echo "/usr/sbin/fping -6 \$@" > /usr/sbin/fping6 chmod +x /usr/sbin/fping6 +setcap cap_net_raw+ep /usr/sbin/fping6 cat > ${LIBRENMS_PATH}/config.d/fping.php < Date: Fri, 21 Sep 2018 16:26:27 -0400 Subject: [PATCH 4/5] Fixes for `validate.php` nologin errors and missing setfacl binaries ``` [FAIL] fping could not be executed. fping must have CAP_NET_RAW capability (getcap) or suid. Selinux exlusions may be required. () [FAIL] fping6 could not be executed. fping6 must have CAP_NET_RAW capability (getcap) or suid. Selinux exlusions may be required. () nologin: unrecognized option: c Try 'nologin --help' for more information. ``` --- Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index b13076e..e3987e0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,6 +16,7 @@ LABEL maintainer="CrazyMax" \ org.label-schema.schema-version="1.0" RUN apk --update --no-cache add \ + acl \ bash \ binutils \ ca-certificates \ @@ -79,12 +80,13 @@ ENV LIBRENMS_VERSION="1.43" \ RUN mkdir -p /opt \ && addgroup -g 1000 librenms \ - && adduser -u 1000 -G librenms -h ${LIBRENMS_PATH} -s /sbin/nologin -D librenms \ + && adduser -u 1000 -G librenms -h ${LIBRENMS_PATH} -s /bin/sh -D librenms \ + && passwd -l librenms \ && usermod -a -G librenms nginx \ && curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer \ && git clone --branch ${LIBRENMS_VERSION} https://github.com/librenms/librenms.git ${LIBRENMS_PATH} \ && chown -R librenms. ${LIBRENMS_PATH} \ - && su - librenms -s /bin/sh -c "composer install --no-dev --no-interaction --no-ansi --working-dir=${LIBRENMS_PATH}" \ + && su - librenms -c "composer install --no-dev --no-interaction --no-ansi --working-dir=${LIBRENMS_PATH}" \ && wget -q https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro -O /usr/bin/distro \ && chmod +x /usr/bin/distro \ && rm -rf /tmp/* From 6028e2ffe4cf18eaba6b37900b7526e06eb4559d Mon Sep 17 00:00:00 2001 From: Jonathan Senecal Date: Fri, 21 Sep 2018 16:27:10 -0400 Subject: [PATCH 5/5] Revert "Add CAP_NET_RAW on fping6" This is not required since the fping6 exe is a script that calls fping bin (which has CAP_NET_RAW) This reverts commit 5eb35a1e5566f987090b99487311e4c0eb42eaf0. --- entrypoint.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/entrypoint.sh b/entrypoint.sh index 7956499..c6b99a3 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -145,7 +145,6 @@ EOL # Config : Fping echo "/usr/sbin/fping -6 \$@" > /usr/sbin/fping6 chmod +x /usr/sbin/fping6 -setcap cap_net_raw+ep /usr/sbin/fping6 cat > ${LIBRENMS_PATH}/config.d/fping.php <