mirror
/
docker-baseimage-ubuntu
kopia lustrzana https://github.com/linuxserver/docker-baseimage-ubuntu
1
0
Forkuj 0
Kod Zgłoszenia Packages Projekty Wydania Wiki Aktywność

Merge pull request #131 from linuxserver/focal-legacy-scripts 

Remove legacy script handlers
pull/132/head focal-2e4844b6-ls102
Adam 2023-01-02 14:46:29 +00:00 zatwierdzone przez GitHub
rodzic 868dd682a8 b4fe9daea9
commit 8d28e076d2
Nie znaleziono w bazie danych klucza dla tego podpisu
ID klucza GPG: 4AEE18F83AFDEB23
2 zmienionych plików z 1 dodań i 140 usunięć
Pokaż statystyki Ściągnij plik aktualizacji Ściągnij plik porównania Expand all files Collapse all files

86
root/docker-mods
Wyświetl plik

@ -28,38 +28,6 @@ tamper_check() {
fi
}
tamper_check_legacy() {
# Tamper check custom script locations
if [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} ! -user root 2>/dev/null)" ]]; then
echo "**** Potential tampering with custom scripts detected ****"
randstr=$(
tr </dev/urandom -dc _A-Z-a-z-0-9 | head -c8
echo
)
mv "${SCRIPTS_DIR_OLD}" "${SCRIPTS_DIR_OLD}.${randstr}"
echo "[custom-init] **** Folder ${SCRIPTS_DIR_OLD} is moved to ${SCRIPTS_DIR_OLD}.${randstr} ****"
echo "[custom-init] **** The folder '${SCRIPTS_DIR_OLD}' and its contents need to all be owned by root to prevent root escalation inside the container!!! ****"
elif [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} -perm -o+w 2>/dev/null)" ]]; then
echo "[custom-init] **** The folder '${SCRIPTS_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****"
echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****"
fi
# Tamper check custom service locations
if [[ -d "${SERVICES_DIR_OLD}" ]] && [[ -n "$(find ${SERVICES_DIR_OLD} ! -user root 2>/dev/null)" ]]; then
echo "[custom-init] **** Potential tampering with custom scripts detected ****"
randstr=$(
tr </dev/urandom -dc _A-Z-a-z-0-9 | head -c8
echo
)
mv "${SERVICES_DIR_OLD}" "${SERVICES_DIR_OLD}.${randstr}"
echo "[custom-init] **** Folder ${SERVICES_DIR_OLD} is moved to ${SERVICES_DIR_OLD}.${randstr} ****"
echo "[custom-init] **** The folder '${SERVICES_DIR_OLD}' and its contents need to all be owned by root to prevent root escalation inside the container!!! ****"
elif [[ -d "${SERVICES_DIR_OLD}" ]] && [[ -n "$(find ${SERVICES_DIR_OLD} -perm -o+w 2>/dev/null)" ]]; then
echo "[custom-init] **** The folder '${SERVICES_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****"
echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****"
fi
}
process_custom_services() {
# Remove all existing custom services before continuing to ensure
# we aren't running anything the user may have removed
@ -90,51 +58,6 @@ process_custom_services() {
else
echo "[custom-init] No custom services found, skipping..."
fi
# Remove legacy folder if it's empty
if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then
echo "[custom-init] Legacy service folder ${SERVICES_DIR_OLD} is empty, deleting..."
rm -rf "${SERVICES_DIR_OLD}"
fi
}
process_custom_services_legacy() {
# Remove all existing custom services before continuing to ensure
# we aren't running anything the user may have removed
if [[ -n "$(/bin/ls -A /etc/s6-overlay/s6-rc.d/custom-svc-* 2>/dev/null)" ]]; then
echo "[custom-init] removing existing custom services..."
rm -rf /etc/s6-overlay/s6-rc.d/custom-svc-*
rm /etc/s6-overlay/s6-rc.d/user/contents.d/custom-svc-*
fi
# Make sure custom service directory exists and has files in it
if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then
echo "[custom-init] Service files found in ${SERVICES_DIR_OLD}"
for SERVICE in "${SERVICES_DIR_OLD}"/*; do
NAME="$(basename "${SERVICE}")"
if [[ -f "${SERVICE}" ]]; then
echo "[custom-init] ${NAME}: service detected, copying..."
mkdir -p /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/dependencies.d/
cp "${SERVICE}" /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/run
chmod +x /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/run
echo "longrun" >/etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/type
touch /etc/s6-overlay/s6-rc.d/custom-svc-"${NAME}"/dependencies.d/init-services
touch /etc/s6-overlay/s6-rc.d/user/contents.d/custom-svc-"${NAME}"
echo "[custom-init] ${NAME}: copied"
elif [[ ! -f "${SERVICE}" ]]; then
echo "[custom-init] ${NAME}: is not a file"
fi
done
else
echo "[custom-init] No custom services found, skipping..."
fi
# Remove legacy folder if it's empty
if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then
echo "[custom-init] Legacy service folder ${SERVICES_DIR_OLD} is empty, deleting..."
rm -rf "${SERVICES_DIR_OLD}"
fi
}
# Check for curl
@ -266,17 +189,10 @@ run_mods() {
# Main script loop
SCRIPTS_DIR_OLD="/config/custom-cont-init.d"
SCRIPTS_DIR="/custom-cont-init.d"
SERVICES_DIR_OLD="/config/custom-services.d"
SERVICES_DIR="/custom-services.d"
if [ ! -d "/custom-cont-init.d" ] && [ ! -d "/custom-services.d" ]; then
# Tamper check legacy custom folders
tamper_check_legacy
process_custom_services_legacy
else
# Tamper check new custom folders
if [ -d "/custom-cont-init.d" ] || [ -d "/custom-services.d" ]; then
tamper_check
process_custom_services
fi

55
root/etc/cont-init.d/99-custom-files
Wyświetl plik

@ -2,20 +2,7 @@
# shellcheck shell=bash
# Directories
SCRIPTS_DIR_OLD="/config/custom-cont-init.d"
SCRIPTS_DIR="/custom-cont-init.d"
SERVICES_DIR_OLD="/config/custom-services.d"
SERVICES_DIR="/custom-services.d"
# chown legacy folders if they exist
if [[ -e "${SCRIPTS_DIR_OLD}" ]]; then
chown -R 0:0 "${SCRIPTS_DIR_OLD}"
fi
# chown legacy folders if they exist
if [[ -e "${SERVICES_DIR_OLD}" ]]; then
chown -R 0:0 "${SERVICES_DIR_OLD}"
fi
# Make sure custom init directory exists and has files in it
if [[ -e "${SCRIPTS_DIR}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]]; then
@ -30,48 +17,6 @@ if [[ -e "${SCRIPTS_DIR}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)"
echo "[custom-init] ${NAME}: is not a file"
fi
done
# Remove legacy folder if it's empty
if [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then
echo "[custom-init] Legacy files folder ${SCRIPTS_DIR_OLD} is empty, deleting..."
rm -rf "${SCRIPTS_DIR_OLD}"
fi
elif [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then
echo "[custom-init] Files found, executing"
for SCRIPT in "${SCRIPTS_DIR_OLD}"/*; do
NAME="$(basename "${SCRIPT}")"
if [[ -f "${SCRIPT}" ]]; then
echo "[custom-init] ${NAME}: executing..."
/bin/bash "${SCRIPT}"
echo "[custom-init] ${NAME}: exited $?"
elif [[ ! -f "${SCRIPT}" ]]; then
echo "[custom-init] ${NAME}: is not a file"
fi
done
elif [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then
echo "[custom-init] Legacy files folder ${SCRIPTS_DIR_OLD} is empty, deleting..."
rm -rf "${SCRIPTS_DIR_OLD}"
else
echo "[custom-init] No custom files found, skipping..."
fi
if [[ -n "$(/bin/ls -A "${SCRIPTS_DIR_OLD}" 2>/dev/null)" ]] ||
[[ -n "$(/bin/ls -A "${SERVICES_DIR_OLD}" 2>/dev/null)" ]]; then
cat << EOF | tee ${SCRIPTS_DIR_OLD}/README.txt 2>/dev/null
********************************************************
********************************************************
* *
* !!!! *
* Custom scripts or services found in legacy locations *
* !!!! *
* Please move your custom scripts and services *
* to ${SCRIPTS_DIR} and ${SERVICES_DIR} *
* respectively to ensure they continue working. *
* *
* Visit https://linuxserver.io/custom for more info. *
* *
********************************************************
********************************************************
EOF
fi
exit 0