From ce51083aaf946bdeffeae7f484f878b83ac9c6ce Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Sat, 14 Sep 2019 23:02:43 +0200 Subject: [PATCH] Review data permissions Remove usermod/groupmod (Issue #38) --- .res/patreon.png | Bin 896 -> 956 bytes .res/paypal.png | Bin 897 -> 956 bytes CHANGELOG.md | 5 +++++ README.md | 2 ++ entrypoint.sh | 21 +++++++++++++-------- 5 files changed, 20 insertions(+), 8 deletions(-) diff --git a/.res/patreon.png b/.res/patreon.png index 9880e74993a5e2a55511aa3bef66cf672934bb12..8b716190abbdde5915e4dfe0257b56ef6f9a6d14 100644 GIT binary patch delta 843 zcmV-R1GM~r2fPQ683+ad007F8#l(>zMh6fE1=GGZ;gN19e*+OoL_t(|+U=abYui8+ z$Mr`w$v@EAg?3B>^_V47r({W%WC#QbhC;zphfM9#O_QfAp_2#GU#_WwV=r}ZT(I3Z zKJ4(VPLi!(r=PBo&V2`84AM#O>3!}!-5E{_0EK;PD6QfSw5S>rYif$Ne_6nle)8(kiZ2e3b5pW*gp@7= zwXGt-lUW2$Vi7!vMermR!IM}^!5g&TXl)Dv`gP8#7&rTvP3+ze!#*Y#A8=F3J_xdE zweYrIW6&HSy!CN^ew=wAWYp^5ZC7x2i)i*lEF>|+XebDOOy!CMwyuNJko3u^j|^C%rW!{)G# zp0Kore+?|_T)B=JMi{I7H~e}08D7EIQ*GRR%=5Ea#chA#Z;s$;Z@=Rq4ZGV*+(g=q z&b(f&jd9s?&KW3C=9MjIo`AXsh277#Zw(Y@)?0lzEH7N|b#|Y;z}q-ZQ92p!&v#?k z^}{nWW8?xBS|&r_xd#Qe<-f0cpp1kWr~i0;uTx(EA9{0$Zn ze^4KUd6{+i7no%M?>Eo0xhF)y6BgUYb%6Iz6f+x~ehD(o_T95oC`Uaf1nWufd)Rv) zf=42F>m!0Ev6h0@d39<|KnxuwnC_D@heslKB!c(yDf9z z6e*q-n=9FuhLL@=tvUbVeCE5D`F3<;En_<0pl*CnV3R&5kZb9DTE!ROAAsQ8{sIEV VY)!K4uVnxL002ovPDHLkV1n-(l@9;_ delta 782 zcmV+p1M&R42Y?5V83+OZ002esQj?J(Mh5{EDC%nBL6L4Je*)D>L_t(|+U=XaPuoBg z$Nfh&$v@CImD({yYDN~OPO!iN0}@iDNR=vO>c9j`H&32eP^S!03r#H?nPh2DaHYf$ zd`gge=U<#J=lD!$&Q9+1RffCE^S#f#dv}4eN_UcBvw0zN7?A zK{KloGzHD9Djm(C;RK~SoN4VHsbkHY+J2A6k!hcu-qiRznKzo%PeaXe=*4_E-skRT zerQ%3_qWd60)Vm>Ko_UE`S%BKl8bqFz~9@<(>yqze=x8_MN_)Gz0Eq!{+Y=L({cWc zw)i`oX_{C~a3lN38*w1gKN!R@Pfn#~Lf}lRma+q&LRclERu${j}M5vhR;! zSv2)8f4?3XVcwqK6j*77u{mgV$91eSbdQM5y2}xB9-9xpHL&kaPZ;=a6C{XJ#(M@$ z%b{7=XIt#x;doPLqv^(!6+)!1ZW>K&KA^#f1#EgOBI2+bmnN2BW;_3Hnq_@Q1$F{U zIKy)fo5Y?TNr=&8GKVIH&kI$exR{^|WVoTuf1W9SrE{f;fGT$E<_;#`zxEO=lPf(! znYy}@Y0~$oJkW%yZVyy_5)IO+(Hb6YF<6eFNg!jV89P16D?J-DL)CWsdx!mOen4rS^3?T0IIt9W7g zw_(B0HbN_IYA+C#-sNnd=@R;r*@gQSK~cO#@GKQ&qw*eHqPGbC0btGz%Z!&HPXGV_ M07*qoM6N<$f)j3bK>z>% diff --git a/.res/paypal.png b/.res/paypal.png index 24c3954ad6567b6dca8ab4e4f841060fa6d39ba8..e23c83d249972a4b53cd7eef56d50445ae00e4d8 100644 GIT binary patch delta 843 zcmV-R1GM~s2fPQ683+ad001_J?hcV5Mh6fC1>uNPW07tre*+OoL_t(|+U=V$Z__{& z$4&VVFu>fAkHE;t$jHc;u@YsEVClfXg5;%AI&|nzscaDg3Py?oLu6%1rGgsCLn<*4 zsmtqoPMn-y?i^oYbI)*={!$t{ckkZs?!9-eE&zbw+b;+nwgK+H!9NbYT!?&645FV9 z5R>5hH3WMee~1jd1|Sv#WD-1nC%_=D9GsNNJ=cbKttm|@u8r_A$hiSt9!#U;+yE~R zrctV+(fyAAFHZD&_FllCo1n@YL@1ZA`HDvf>PUbCq^j};KLgB4fT3%a06cf?0I90F z!KXh;QdwNRPXe4EQB^nC8ry-1`vROGQB^k>CYE3#e=HXM#az>$k1v!0ru)YZOy?Y6 zGPTS#_?sI|Tix@TCs@){FgWvL8!8B-HJX3CII{<%g2+N>Rd7-;3`A@LM-&*tOg3Fz zO#Hpu`Dd#lKm#UQtvBQPz*sq36qtT_D1#^;E_PipYtH181fjKxoX)^%pJDy-=nzT; zqpQeff43`9F6j*cUY_FMrpiNjuf4^}ELt(-*pS^@I$Gy6*5;-aLt|C@PoG!divq(F z<^>x50rxc>5&{|E{fVYHuns>OFj?OwN2HTRaU6kCOZD`A!rDvL`!w3hK}Z6_E3%_6 zC1M&m%eGwB8dim=h8(8f01BvG50sX!LXRgr3SDBroUvJqgKA&pL0k@3Z<(L$($@wsYY+_Ik@IO4&^;ca z3c=`{E*4D0@&@itI@A1jTN`P+Vz^VX6~x0`f9`w=V}%u7iT+~{3g*>_#p7tTM=|Aq zf7-wtvK)bZhhx1BrcL9fP{#91D0Ri`pC}a=s&&f#FJtpM<1Z=(p)XQvYnW9|Rqej<#+#uVr1@s z+rwHRvpof54jMJDXai}dtp{0eS&XdH#eAVq(Yknwe|PM4E4qPM zJg4_&iDo7jf;f4Kj7-zQ){iVPU9Q%FMCIy_add^=VsmbdmRihaMwvihlY;?{grB5) zUX%%gf5Y+Re>U{>A){6Hri&jVbcDtjdYH$j1*QCoBl8DOyCLt>##MnYT*1iW9_j1F zhRra5V$z0;PM7Up`S~e4R9R#sDq|P|soN8tqL?VY#EeN7hKbD3jV!7Q|8O$S#xiVR2~c-4SYmPGJj%VZyB)Ky!8*f!OYXxK?HTgZyn1Pefj|HN N002ovPDHLkV1j~8f(QTr diff --git a/CHANGELOG.md b/CHANGELOG.md index 21e0bdd..b3e5f04 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 1.55-RC2 (2019/09/14) + +* Review data permissions +* Remove usermod/groupmod (Issue #38) + ## 1.55-RC1 (2019/09/04) * LibreNMS 1.55 diff --git a/README.md b/README.md index 0c01647..022c534 100644 --- a/README.md +++ b/README.md @@ -105,6 +105,8 @@ It's a fork of [CrazyMax's LibreNMS Docker image repository](https://github.com/ * `/data` : Contains configuration, rrd database, logs, additional Monitoring plugins, additional syslog-ng config files +> :warning: Note that the volume should be owned by the user/group with the specified `PUID` and `PGID`. If you don’t give the volume correct permissions, the container may not start. + ### Ports * `80` : HTTP port diff --git a/entrypoint.sh b/entrypoint.sh index ae1f93f..7303e75 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -74,11 +74,12 @@ sed -i -e "s|date\.timezone.*|date\.timezone = ${TZ}|" /etc/php7/php.ini \ # Change librenms UID / GID echo "Checking if librenms UID / GID has changed..." -if [ $(id -u librenms) != ${PUID} ]; then - usermod -u ${PUID} librenms +if [ -n "${PGID}" ] && [ "${PGID}" != "`id -g librenms`" ]; then + sed -i -e "s/^librenms:\([^:]*\):[0-9]*/librenms:\1:${PGID}/" /etc/group + sed -i -e "s/^librenms:\([^:]*\):\([0-9]*\):[0-9]*/librenms:\1:\2:${PGID}/" /etc/passwd fi -if [ $(id -g librenms) != ${PGID} ]; then - groupmod -g ${PGID} librenms +if [ -n "${PUID}" ] && [ "${PUID}" != "`id -u librenms`" ]; then + sed -i -e "s/^librenms:\([^:]*\):[0-9]*:\([0-9]*\)/librenms:\1:${PUID}:\2/" /etc/passwd fi # PHP @@ -213,8 +214,11 @@ fi # Fix perms echo "Fixing permissions..." -chown -R librenms. ${DATA_PATH} \ - ${LIBRENMS_PATH}/config.d \ +chown librenms. ${DATA_PATH}/config \ + ${DATA_PATH}/logs \ + ${DATA_PATH}/monitoring-plugins \ + ${DATA_PATH}/rrd +chown -R librenms. ${LIBRENMS_PATH}/config.d \ ${LIBRENMS_PATH}/bootstrap \ ${LIBRENMS_PATH}/storage chmod ug+rw ${DATA_PATH}/logs \ @@ -263,7 +267,7 @@ if [ "$SIDECAR_CRON" = "1" ]; then # Add crontab cat ${LIBRENMS_PATH}/librenms.nonroot.cron > ${CRONTAB_PATH}/librenms sed -i -e "s/ librenms //" ${CRONTAB_PATH}/librenms - + if [ $LIBRENMS_CRON_DISCOVERY_ENABLE != true ]; then sed -i "/discovery.php/d" ${CRONTAB_PATH}/librenms fi @@ -306,7 +310,8 @@ elif [ "$SIDECAR_SYSLOGNG" = "1" ]; then # Init rm /etc/supervisord/cron.conf /etc/supervisord/nginx.conf /etc/supervisord/php.conf /etc/supervisord/snmpd.conf mkdir -p ${DATA_PATH}/syslog-ng /run/syslog-ng - chown -R librenms. ${DATA_PATH}/syslog-ng /run/syslog-ng + chown librenms. ${DATA_PATH}/syslog-ng + chown -R librenms. /run/syslog-ng else # Init rm /etc/supervisord/cron.conf /etc/supervisord/syslog-ng.conf