You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@guacamole.apache.org by GitBox <gi...@apache.org> on 2020/11/30 21:14:01 UTC
[GitHub] [guacamole-server] benrubson opened a new pull request #314: GUACAMOLE-1110: Replace user nobody with guacd
benrubson opened a new pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314
Hi,
This PR is a slight modification to #292 which has been merged in `staging/1.3.0` (thus my PR against this branch).
It creates a dedicated group for the `guacd` service user.
So that it is not assigned to the default `users` group, among other possible users...
Thank you 👍
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] benrubson commented on a change in pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
benrubson commented on a change in pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#discussion_r537371282
##########
File path: Dockerfile
##########
@@ -115,7 +115,8 @@ HEALTHCHECK --interval=5m --timeout=5s CMD nc -z 127.0.0.1 4822 || exit 1
# Create a new user guacd
ARG UID=1000
-RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --no-user-group guacd
+RUN groupadd --gid $UID guacd
+RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $UID guacd
Review comment:
Note that there's no risk for both `UID` and `GID` to have the same numerical value (`1000` here).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] mike-jumper commented on a change in pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
mike-jumper commented on a change in pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#discussion_r537382418
##########
File path: Dockerfile
##########
@@ -115,7 +115,8 @@ HEALTHCHECK --interval=5m --timeout=5s CMD nc -z 127.0.0.1 4822 || exit 1
# Create a new user guacd
ARG UID=1000
-RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --no-user-group guacd
+RUN groupadd --gid $UID guacd
+RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $UID guacd
Review comment:
Well ... there is no risk if they _happen_ to have the same value, or if the same value is intentionally chosen for both the UID and the GID after that value was been confirmed to be available within both UID and GID pools.
The important thing is to not have the image build written to directly use a UID as if it were a GID.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] benrubson commented on pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
benrubson commented on pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#issuecomment-742293695
Many thanks @mike-jumper 👍
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] mike-jumper commented on a change in pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
mike-jumper commented on a change in pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#discussion_r537350327
##########
File path: Dockerfile
##########
@@ -115,7 +115,8 @@ HEALTHCHECK --interval=5m --timeout=5s CMD nc -z 127.0.0.1 4822 || exit 1
# Create a new user guacd
ARG UID=1000
-RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --no-user-group guacd
+RUN groupadd --gid $UID guacd
+RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $UID guacd
Review comment:
I don't think the GID should be set to the UID (or that it should be assumed that doing so is safe). Perhaps this should be its own `ARG`?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] benrubson commented on a change in pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
benrubson commented on a change in pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#discussion_r537358680
##########
File path: Dockerfile
##########
@@ -115,7 +115,8 @@ HEALTHCHECK --interval=5m --timeout=5s CMD nc -z 127.0.0.1 4822 || exit 1
# Create a new user guacd
ARG UID=1000
-RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --no-user-group guacd
+RUN groupadd --gid $UID guacd
+RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $UID guacd
Review comment:
Many thanks for your feedback @mike-jumper, updated accordingly :+1:
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] benrubson commented on a change in pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
benrubson commented on a change in pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#discussion_r537395392
##########
File path: Dockerfile
##########
@@ -115,7 +115,8 @@ HEALTHCHECK --interval=5m --timeout=5s CMD nc -z 127.0.0.1 4822 || exit 1
# Create a new user guacd
ARG UID=1000
-RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --no-user-group guacd
+RUN groupadd --gid $UID guacd
+RUN useradd --system --create-home --shell /usr/sbin/nologin --uid $UID --gid $UID guacd
Review comment:
OK, both UID and GID with a `1000` value are free for use in the image (the free range around 1000 is rather large).
And both are now identified with their own `ARG`.
Should then be OK, or did I perhaps miss something ?
Thank you again 👍
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] benrubson commented on pull request #314: GUACAMOLE-1110: Replace user nobody with guacd
Posted by GitBox <gi...@apache.org>.
benrubson commented on pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314#issuecomment-736068778
@IT-Experte @mike-jumper @necouchman could you please review / merge this, which completes #292 in `staging/1.3.0` ?
Note that same dedicated user/group creation has been applied in https://github.com/apache/guacamole-client/pull/554.
Thank you very much 👍
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-server] mike-jumper merged pull request #314: GUACAMOLE-1110: Create a proper dedicated service group
Posted by GitBox <gi...@apache.org>.
mike-jumper merged pull request #314:
URL: https://github.com/apache/guacamole-server/pull/314
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org