hazza/docker-stacks
1
0
Fork 0
mirror of https://github.com/jupyter/docker-stacks.git synced 2025-10-18 15:32:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove writable group file due to issues with being able to give su access when shouldn't be allowed.

Browse Source
This commit is contained in:
Graham Dumpleton
2018-06-06 14:21:03 +10:00
parent cf57ef145d
commit fce599596e
2 changed files with 2 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
base-notebook/Dockerfile
View File

@@ -50,7 +50,7 @@ ADD fix-permissions /usr/local/bin/fix-permissions
RUN useradd -m -s /bin/bash -N -u $NB_UID $NB_USER && \ RUN useradd -m -s /bin/bash -N -u $NB_UID $NB_USER && \
mkdir -p $CONDA_DIR && \ mkdir -p $CONDA_DIR && \
chown $NB_USER:$NB_GID $CONDA_DIR && \ chown $NB_USER:$NB_GID $CONDA_DIR && \
chmod g+w /etc/passwd /etc/group && \ chmod g+w /etc/passwd && \
fix-permissions $HOME && \ fix-permissions $HOME && \
fix-permissions $CONDA_DIR fix-permissions $CONDA_DIR

8
base-notebook/start.sh
View File

@@ -94,8 +94,7 @@ else
# User is not attempting to override user/group via environment # User is not attempting to override user/group via environment
# variables, but they could still have overridden the uid/gid that # variables, but they could still have overridden the uid/gid that
# container runs as. Check that the user has an entry in the passwd # container runs as. Check that the user has an entry in the passwd
# file and if not add an entry. Also add a group file entry if the # file and if not add an entry.
# uid has its own distinct group but there is no entry.
whoami &> /dev/null || STATUS=$? && true whoami &> /dev/null || STATUS=$? && true
if [[ "$STATUS" != "0" ]]; then if [[ "$STATUS" != "0" ]]; then
if [[ -w /etc/passwd ]]; then if [[ -w /etc/passwd ]]; then
@@ -104,11 +103,6 @@ else
echo "jovyan:x:$(id -u):$(id -g):,,,:/home/jovyan:/bin/bash" >> /tmp/passwd echo "jovyan:x:$(id -u):$(id -g):,,,:/home/jovyan:/bin/bash" >> /tmp/passwd
cat /tmp/passwd > /etc/passwd cat /tmp/passwd > /etc/passwd
rm /tmp/passwd rm /tmp/passwd
id -G -n 2>/dev/null | grep -q -w $(id -u) || STATUS=$? && true
if [[ "$STATUS" != "0" && "$(id -g)" == "0" ]]; then
echo "Adding group file entry for $(id -u)"
echo "jovyan:x:$(id -u):" >> /etc/group
fi
else else
echo 'Container must be run with group "root" to update passwd file' echo 'Container must be run with group "root" to update passwd file'
fi fi