[BUG] feature-policy.conf and permissions-policy.conf don't change

[pjorritsma]

Description
trying to allow GPS (Location) on the website

How to reproduce
Add the following code to docker-compose and run:

  - "bunkerized-nginx.FEATURE_POLICY=accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; camera 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; fullscreen 'none'; geolocation '*'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; speaker 'none'; sync-xhr 'none'; usb 'none'; vibrate 'none'; vr 'none';"
  - "bunkerized-nginx.PERMISSIONS_POLICY=accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=('*' https://url.it), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), speaker=(), sync-xhr=(), usb=(), vibrate=(), vr=()"

When looking in the files: feature-policy.conf and permissions-policy.conf notthing is changed

Logs
Can't find any reference in the logs

[fl0ppy-d1sk]

Hello @pjorritsma,

Can you share the full docker-compose.yml (don't forget to edit sensitive data) please ?

[pjorritsma]

Hello @fl0ppy-d1sk ,

Just use the standaard bunkerized docker-compose with autoconf from the wiki site. With the following labels for website:

  - "bunkerized-nginx.SERVER_NAME=domain"
  - "bunkerized-nginx.USE_MODSECURITY_CRS=no"
  - "bunkerized-nginx.USE_BAD_BEHAVIOR=no"
  - "bunkerized-nginx.BLOCK_USER_AGENT=yes"
  - "bunkerized-nginx.USE_MODSECURITY=no"
  - "bunkerized-nginx.USE_LIMIT_CONN=no"
  - "bunkerized-nginx.USE_LIMIT_REQ=no"
  - "bunkerized-nginx.COOKIE_AUTO_SECURE_FLAG=no"
  - "bunkerized-nginx.ALLOWED_METHODS=GET|POST|HEAD|COPY|DELETE|LOCK|MKCOL|MOVE|PROPFIND|PROPPATCH|PUT|UNLOCK|OPTIONS"
  - "bunkerized-nginx.MAX_CLIENT_SIZE=20m"
  - "bunkerized-nginx.USE_REVERSE_PROXY=yes"
  - "bunkerized-nginx.REVERSE_PROXY_BUFFERING=no"
  - "bunkerized-nginx.BLOCK_PROXIES=yes"
  - "bunkerized-nginx.USE_WHITELIST_REVERSE=no"
  - "bunkerized-nginx.WHITELIST_COUNTRY=Country"
  - "bunkerized-nginx.REVERSE_PROXY_URL=/"
  - "bunkerized-nginx.REVERSE_PROXY_HOST=http://app:8080"

Did try to add those rules above but don't work or put in the file on dictory

[fl0ppy-d1sk]

Hello @pjorritsma,

Looks like I can't reproduce your issue. Here is what I did.

docker-compose-autoconf.yml :

version: '3'

services:

  mybunkerized:
    image: bunkerity/bunkerized-nginx
    restart: always
    ports:
      - 80:8080
      - 443:8443
    volumes:
      - bunkerized-vol:/etc/nginx
    environment:
      - SERVER_NAME=
      - MULTISITE=yes
    labels:
      - "bunkerized-nginx.AUTOCONF"
    networks:
      - services-net

  myautoconf:
    image: bunkerity/bunkerized-nginx-autoconf
    restart: always
    volumes_from:
      - mybunkerized
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - mybunkerized

volumes:
  bunkerized-vol:

networks:
  services-net:
    name: services-net

docker-compose-service.yml :

version: "3"

services:

  myservice:
    image: tutum/hello-world
    networks:
      services-net:
        aliases:
          - myservice
    labels:
      - "bunkerized-nginx.SERVER_NAME=www.example.com"
      - "bunkerized-nginx.USE_REVERSE_PROXY=yes"
      - "bunkerized-nginx.REVERSE_PROXY_URL=/"
      - "bunkerized-nginx.REVERSE_PROXY_HOST=http://myservice"
      - "bunkerized-nginx.PERMISSIONS_POLICY=custom value for Permissions-Policy"
      - "bunkerized-nginx.FEATURE_POLICY=custom value for Feature-Policy"

networks:
  services-net:
    external:
      name: services-net

Run bunkerized-nginx + autoconf and wait until everything is started (e.g. "bunkerized-nginx instances started" in logs) :

docker-compose -f docker-compose-autoconf.yml pull
docker-compose -f docker-compose-autoconf.yml up -d
docker-compose -f docker-compose-autoconf.yml logs -f

Run the service :

docker-compose -f docker-compose-service.yml pull
docker-compose -f docker-compose-service.yml up -d

And check the headers :

curl http://localhost -H "Host: www.example.com" -H "User-Agent: Legit" -vvv
[...]
< Feature-Policy: custom value for Feature-Policy
< Permissions-Policy: custom value for Permissions-Policy
[...]

[pjorritsma]

Hello Floppy,

Thanks you so much for the response. Can you give me a example how you will define to allow GPS location on the site. This is what is currently blocked:

  - "bunkerized-nginx.PERMISSIONS_POLICY=custom value for Permissions-Policy"
  - "bunkerized-nginx.FEATURE_POLICY=custom value for Feature-Policy"

So do I need to adjust custom vlue with

• "bunkerized-nginx.FEATURE_POLICY=accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; camera 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; fullscreen 'none'; geolocation '*'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; speaker 'none'; sync-xhr 'none'; usb 'none'; vibrate 'none'; vr 'none';"
  • "bunkerized-nginx.PERMISSIONS_POLICY=accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=('*' https://url.it), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), speaker=(), sync-xhr=(), usb=(), vibrate=(), vr=()"

All the values or is just geolocation '*' anough. The last time a i try the above it don't edit the config files.

Thanks in adv.

[pjorritsma]

Hello Fl0ppy could you help with stil issue?