185b574bdc
Docker generates an apparmor profile on the fly under /etc/apparmor.d/docker.
This profile gets overwritten on every docker daemon start.
This profile allows processes to ptrace themselves. This is required by
circus (python process manager) for reasons unknown to me. It floods the logs
with
audit[7623]: <audit-1400> apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7623 comm="python3.4" requested_mask="trace" denied_mask="trace" peer="docker-default"
This is easily tested using:
docker run -it cloudron/base:0.3.3 /bin/bash
a) now do ps
b) journalctl should show error log as above
docker run --security-opt=apparmor:docker-cloudron-app -it cloudron/base:0.3.3 /bin/bash
a) now do ps
b) no error!
Note that despite this, the process may not have ability to ptrace since it does not
have CAP_PTRACE. Also, security-opt is the profile name (inside the apparmor config file)
and not the filename.
References:
https://groups.google.com/forum/#!topic/docker-user/xvxpaceTCyw
https://github.com/docker/docker/issues/7276
https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1320869
This is an infra update because we need to recreate containers to get the right profile.
Fixes #492
44 lines
1.1 KiB
Bash
Executable File
44 lines
1.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -eu -o pipefail
|
|
|
|
# This file can be used in Dockerfile
|
|
|
|
readonly container_files="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/container"
|
|
|
|
readonly CONFIG_DIR="/home/yellowtent/configs"
|
|
readonly DATA_DIR="/home/yellowtent/data"
|
|
|
|
########## create config directory
|
|
rm -rf "${CONFIG_DIR}"
|
|
sudo -u yellowtent mkdir "${CONFIG_DIR}"
|
|
|
|
########## systemd
|
|
cp -r "${container_files}/systemd/." /etc/systemd/system/
|
|
systemctl daemon-reload
|
|
systemctl enable cloudron.target
|
|
|
|
########## sudoers
|
|
rm /etc/sudoers.d/*
|
|
cp "${container_files}/sudoers" /etc/sudoers.d/yellowtent
|
|
|
|
########## collectd
|
|
rm -rf /etc/collectd
|
|
ln -sfF "${DATA_DIR}/collectd" /etc/collectd
|
|
|
|
########## apparmor docker profile
|
|
cp "${container_files}/docker-cloudron-app.apparmor" /etc/apparmor.d/docker-cloudron-app
|
|
systemctl restart apparmor
|
|
|
|
########## nginx
|
|
# link nginx config to system config
|
|
unlink /etc/nginx 2>/dev/null || rm -rf /etc/nginx
|
|
ln -s "${DATA_DIR}/nginx" /etc/nginx
|
|
|
|
########## mysql
|
|
cp "${container_files}/mysql.cnf" /etc/mysql/mysql.cnf
|
|
|
|
########## Enable services
|
|
update-rc.d -f collectd defaults
|
|
|