Review data permissions

Remove usermod/groupmod (Issue #38)

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.55-RC2 (2019/09/14)
+
+* Review data permissions
+* Remove usermod/groupmod (Issue #38)
+
 ## 1.55-RC1 (2019/09/04)
 
 * LibreNMS 1.55

README.md

@@ -105,6 +105,8 @@ It's a fork of [CrazyMax's LibreNMS Docker image repository](https://github.com/
 
 * `/data` : Contains configuration, rrd database, logs, additional Monitoring plugins, additional syslog-ng config files
 
+> :warning: Note that the volume should be owned by the user/group with the specified `PUID` and `PGID`. If you don’t give the volume correct permissions, the container may not start.
+
 ### Ports
 
 * `80` : HTTP port

entrypoint.sh

@@ -74,11 +74,12 @@ sed -i -e "s|date\.timezone.*|date\.timezone = ${TZ}|" /etc/php7/php.ini \
 
 # Change librenms UID / GID
 echo "Checking if librenms UID / GID has changed..."
-if [ $(id -u librenms) != ${PUID} ]; then
-  usermod -u ${PUID} librenms
+if [ -n "${PGID}" ] && [ "${PGID}" != "`id -g librenms`" ]; then
+  sed -i -e "s/^librenms:\([^:]*\):[0-9]*/librenms:\1:${PGID}/" /etc/group
+  sed -i -e "s/^librenms:\([^:]*\):\([0-9]*\):[0-9]*/librenms:\1:\2:${PGID}/" /etc/passwd
 fi
-if [ $(id -g librenms) != ${PGID} ]; then
-  groupmod -g ${PGID} librenms
+if [ -n "${PUID}" ] && [ "${PUID}" != "`id -u librenms`" ]; then
+  sed -i -e "s/^librenms:\([^:]*\):[0-9]*:\([0-9]*\)/librenms:\1:${PUID}:\2/" /etc/passwd
 fi
 
 # PHP
@@ -213,8 +214,11 @@ fi
 
  # Fix perms
 echo "Fixing permissions..."
-chown -R librenms. ${DATA_PATH} \
-  ${LIBRENMS_PATH}/config.d \
+chown librenms. ${DATA_PATH}/config \
+  ${DATA_PATH}/logs \
+  ${DATA_PATH}/monitoring-plugins \
+  ${DATA_PATH}/rrd
+chown -R librenms. ${LIBRENMS_PATH}/config.d \
   ${LIBRENMS_PATH}/bootstrap \
   ${LIBRENMS_PATH}/storage
 chmod ug+rw ${DATA_PATH}/logs \
@@ -263,7 +267,7 @@ if [ "$SIDECAR_CRON" = "1" ]; then
   # Add crontab
   cat ${LIBRENMS_PATH}/librenms.nonroot.cron > ${CRONTAB_PATH}/librenms
   sed -i -e "s/ librenms //" ${CRONTAB_PATH}/librenms
-  
+
   if [ $LIBRENMS_CRON_DISCOVERY_ENABLE != true ]; then
     sed -i "/discovery.php/d" ${CRONTAB_PATH}/librenms
   fi
@@ -306,7 +310,8 @@ elif [ "$SIDECAR_SYSLOGNG" = "1" ]; then
   # Init
   rm /etc/supervisord/cron.conf /etc/supervisord/nginx.conf /etc/supervisord/php.conf /etc/supervisord/snmpd.conf
   mkdir -p ${DATA_PATH}/syslog-ng /run/syslog-ng
-  chown -R librenms. ${DATA_PATH}/syslog-ng /run/syslog-ng
+  chown librenms. ${DATA_PATH}/syslog-ng
+  chown -R librenms. /run/syslog-ng
 else
   # Init
   rm /etc/supervisord/cron.conf /etc/supervisord/syslog-ng.conf