openstack/kolla-ansible
Code Issues Proposed changes

Merge "Drop root privileges for rabbitmq"

Browse Source
This commit is contained in:
Jenkins 2015-11-13 07:53:06 +00:00 committed by Gerrit Code Review
commit 52bd56e686
4 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/rabbitmq/templates/rabbitmq.json.j2
View File

@ -1,5 +1,5 @@
{ {
"command": "sudo -H -u rabbitmq /usr/sbin/rabbitmq-server", "command": "/usr/sbin/rabbitmq-server",
"config_files": [ "config_files": [
{ {
"source": "{{ container_config_directory }}/rabbitmq-env.conf", "source": "{{ container_config_directory }}/rabbitmq-env.conf",

8
docker/rabbitmq/Dockerfile.j2
View File

@ -28,6 +28,12 @@ RUN /usr/lib/rabbitmq/bin/rabbitmq-plugins enable --offline \
&& /bin/true && /bin/true
COPY extend_start.sh /usr/local/bin/kolla_extend_start COPY extend_start.sh /usr/local/bin/kolla_extend_start
RUN chmod 755 /usr/local/bin/kolla_extend_start COPY rabbitmq_sudoers /etc/sudoers.d/rabbitmq_sudoers
RUN chmod 755 /usr/local/bin/kolla_extend_start \
&& chmod 750 /etc/sudoers.d \
&& chmod 440 /etc/sudoers.d/rabbitmq_sudoers \
&& usermod -a -G kolla rabbitmq
{{ include_footer }} {{ include_footer }}
USER rabbitmq

2
docker/rabbitmq/extend_start.sh
View File

@ -3,8 +3,8 @@
# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
# of the KOLLA_BOOTSTRAP variable being set, including empty. # of the KOLLA_BOOTSTRAP variable being set, including empty.
if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
sudo chown -R rabbitmq: /var/lib/rabbitmq
echo "${RABBITMQ_CLUSTER_COOKIE}" > /var/lib/rabbitmq/.erlang.cookie echo "${RABBITMQ_CLUSTER_COOKIE}" > /var/lib/rabbitmq/.erlang.cookie
chown -R rabbitmq: /var/lib/rabbitmq
chmod 400 /var/lib/rabbitmq/.erlang.cookie chmod 400 /var/lib/rabbitmq/.erlang.cookie
exit 0 exit 0
fi fi

1
docker/rabbitmq/rabbitmq_sudoers Normal file
View File

@ -0,0 +1 @@
%kolla ALL=(root) NOPASSWD: /usr/bin/chown -R rabbitmq\: /var/lib/rabbitmq, /bin/chown -R rabbitmq\: /var/lib/rabbitmq