"Error: Out of memory" if dynsec path owned by root and no config file

[sezanzeb]

Using the eclipse-mosquitto docker image

➜  mosquitto git:(main) ✗ uname -r     
5.13.19-2-MANJARO
➜  mosquitto git:(main) ✗ pacman -Q | grep docker
docker 1:20.10.14-1

mosquitto.conf:

# mqtt
listener 1883
allow_anonymous true

# unencrypted ws
listener 8080
protocol websockets
allow_anonymous true

# encrypted ws
listener 8081
protocol websockets
allow_anonymous true

# dynsec plugin
plugin /usr/lib/mosquitto_dynamic_security.so
plugin_opt_config_file /dynsec

Dockerfile:

FROM eclipse-mosquitto
COPY mosquitto.conf /mosquitto/config/
RUN mkdir /dynsec
RUN chown mosquitto:mosquitto /dynsec

without chown:

➜  mosquitto git:(main) ✗ docker build . --tag mosquitto && docker run mosquitto            
Sending build context to Docker daemon  7.168kB
Step 1/3 : FROM eclipse-mosquitto
 ---> 58900513926f
Step 2/3 : COPY mosquitto.conf /mosquitto/config/
 ---> Using cache
 ---> 4f5d62cb29d5
Step 3/3 : RUN mkdir /dynsec
 ---> Using cache
 ---> 0874d4177976
Successfully built 0874d4177976
Successfully tagged mosquitto:latest
1650974938: mosquitto version 2.0.14 starting
1650974938: Config loaded from /mosquitto/config/mosquitto.conf.
1650974938: Loading plugin: /usr/lib/mosquitto_dynamic_security.so
1650974938: Error: Out of memory.
1650974938: Opening ipv4 listen socket on port 1883.
1650974938: Opening ipv6 listen socket on port 1883.
1650974938: Opening websockets listen socket on port 8080.
1650974938: Opening websockets listen socket on port 8081.
1650974938: mosquitto version 2.0.14 running

with chown:

➜  mosquitto git:(main) ✗ docker build . --tag mosquitto && docker run mosquitto
Sending build context to Docker daemon  7.168kB
Step 1/4 : FROM eclipse-mosquitto
 ---> 58900513926f
Step 2/4 : COPY mosquitto.conf /mosquitto/config/
 ---> Using cache
 ---> 4f5d62cb29d5
Step 3/4 : RUN mkdir /dynsec
 ---> Using cache
 ---> 0874d4177976
Step 4/4 : RUN chown mosquitto:mosquitto /dynsec
 ---> Using cache
 ---> aaf6adf88ee1
Successfully built aaf6adf88ee1
Successfully tagged mosquitto:latest
1650974960: mosquitto version 2.0.14 starting
1650974960: Config loaded from /mosquitto/config/mosquitto.conf.
1650974960: Loading plugin: /usr/lib/mosquitto_dynamic_security.so
1650974960: Opening ipv4 listen socket on port 1883.
1650974960: Opening ipv6 listen socket on port 1883.
1650974960: Opening websockets listen socket on port 8080.
1650974960: Opening websockets listen socket on port 8081.
1650974960: mosquitto version 2.0.14 running

I would have expected a permission error instead or something.

[sezanzeb]

If the docker file is

FROM eclipse-mosquitto
COPY mosquitto.conf /mosquitto/config/
RUN mkdir /dynsec
# RUN chown mosquitto:mosquitto /dynsec
COPY dynamic-security.json /dynsec

it also works.

It only fails with the out-of-memory error if there is no dynamic-security.json file AND the directory is not owned by mosquitto.

[sezanzeb]

note, that plugin_opt_config_file /dynsec is wrong and should be plugin_opt_config_file /dynsec/dynamic-security.json

[ralight]

This is now fixed for 2.0.15, thank you for the report.