Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(security): secure containers run as non-root #3003

Merged
merged 2 commits into from Jan 9, 2021
Merged

feat(security): secure containers run as non-root #3003

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
688b292
feat(security): secure containers run as non-root
beaufrusetta Jan 8, 2021
d164d0f
Merge branch 'master' into issue-2983-non-root-containers
lenny-goodell Jan 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions cmd/core-command/Dockerfile
View file
Open in desktop
Expand Up @@ -49,5 +49,6 @@ WORKDIR /
COPY --from=builder /edgex-go/cmd/core-command/Attribution.txt /
COPY --from=builder /edgex-go/cmd/core-command/core-command /
COPY --from=builder /edgex-go/cmd/core-command/res/configuration.toml /res/configuration.toml

ENTRYPOINT ["/core-command"]
CMD ["-cp=consul.http://edgex-core-consul:8500", "--registry", "--confdir=/res"]
1 change: 1 addition & 0 deletions cmd/core-metadata/Dockerfile
View file
Open in desktop
Expand Up @@ -49,5 +49,6 @@ WORKDIR /
COPY --from=builder /edgex-go/cmd/core-metadata/Attribution.txt /
COPY --from=builder /edgex-go/cmd/core-metadata/core-metadata /
COPY --from=builder /edgex-go/cmd/core-metadata/res/configuration.toml /res/configuration.toml

ENTRYPOINT ["/core-metadata"]
CMD ["-cp=consul.http://edgex-core-consul:8500", "--registry", "--confdir=/res"]
6 changes: 4 additions & 2 deletions cmd/security-secretstore-setup/Dockerfile
View file
Open in desktop
Expand Up @@ -50,9 +50,11 @@ COPY --from=builder /edgex-go/cmd/security-secretstore-setup/res/configuration.t
COPY --from=builder /edgex-go/cmd/security-file-token-provider/security-file-token-provider .
COPY --from=builder /edgex-go/cmd/security-secretstore-setup/security-secretstore-setup .

# setup the entry point script
# Setup the entry point script, create token dir, and assign perms
COPY --from=builder /edgex-go/cmd/security-secretstore-setup/entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/entrypoint.sh \
&& ln -s /usr/local/bin/entrypoint.sh /
&& ln -s /usr/local/bin/entrypoint.sh / \
&& mkdir -p /vault/config/assets \
&& chown -Rh 100:1000 /vault/

ENTRYPOINT ["entrypoint.sh"]
22 changes: 8 additions & 14 deletions cmd/security-secretstore-setup/entrypoint.sh
View file
Open in desktop
Expand Up @@ -24,27 +24,21 @@ if [ -n "${SECRETSTORE_SETUP_DONE_FLAG}" ] && [ -f "${SECRETSTORE_SETUP_DONE_FLA
rm -f "${SECRETSTORE_SETUP_DONE_FLAG}"
fi

echo "creating /vault/config/assets"
echo "Starting vault-worker..."

# create token directory and
# grant permissions of folders for vault:vault
mkdir -p /vault/config/assets
chown -Rh 100:1000 /vault/

echo "starting vault-worker..."

echo "Initializing secret store"
echo "Initializing secret store..."
/security-secretstore-setup --vaultInterval=10

echo "Executing custom command: $@"
"$@"

Comment on lines -39 to -41
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the security issue I called out in the commit message. This change came in on a commit that @tingyuz and @bnevis-i worked on in Jan 2020. Given that this container is a "run and done" container, we left it with root privileges to appropriately create/distribute secrets. Having root perms to execute whatever command you wanted on the command line is just asking for an injection at some point.

# write a sentinel file when we're done because consul is not
# secure and we don't trust it it access to the EdgeX secret store
if [ -n "${SECRETSTORE_SETUP_DONE_FLAG}" ]; then

echo "Changing ownership of secrets to edgex_user:edgex_group"
chown -R ${EDGEX_USER}:${EDGEX_GROUP} /tmp/edgex/secrets

echo "Signaling secretstore-setup completion"
mkdir -p $(dirname "${SECRETSTORE_SETUP_DONE_FLAG}")
touch "${SECRETSTORE_SETUP_DONE_FLAG}"
mkdir -p $(dirname "${SECRETSTORE_SETUP_DONE_FLAG}") && \
touch "${SECRETSTORE_SETUP_DONE_FLAG}"
fi

echo "Waiting for termination signal"
Expand Down
1 change: 1 addition & 0 deletions cmd/support-notifications/Dockerfile
View file
Open in desktop
Expand Up @@ -49,5 +49,6 @@ COPY --from=builder /etc/ssl /etc/ssl
COPY --from=builder /edgex-go/cmd/support-notifications/Attribution.txt /
COPY --from=builder /edgex-go/cmd/support-notifications/support-notifications /
COPY --from=builder /edgex-go/cmd/support-notifications/res/configuration.toml /res/configuration.toml

ENTRYPOINT ["/support-notifications"]
CMD ["-cp=consul.http://edgex-core-consul:8500", "--registry", "--confdir=/res"]
1 change: 1 addition & 0 deletions cmd/support-scheduler/Dockerfile
View file
Open in desktop
Expand Up @@ -47,5 +47,6 @@ EXPOSE $APP_PORT
COPY --from=builder /edgex-go/cmd/support-scheduler/Attribution.txt /
COPY --from=builder /edgex-go/cmd/support-scheduler/support-scheduler /
COPY --from=builder /edgex-go/cmd/support-scheduler/res/configuration.toml /res/configuration.toml

ENTRYPOINT ["/support-scheduler"]
CMD ["-cp=consul.http://edgex-core-consul:8500", "--registry", "--confdir=/res"]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need newline at end of this file.