You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@guacamole.apache.org by "Jotam (Jira)" <ji...@apache.org> on 2020/01/29 15:18:00 UTC
[jira] [Comment Edited] (GUACAMOLE-890) Guacamole/Guacd Docker
Process Privilege Drop
[ https://issues.apache.org/jira/browse/GUACAMOLE-890?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17025957#comment-17025957 ]
Jotam edited comment on GUACAMOLE-890 at 1/29/20 3:17 PM:
----------------------------------------------------------
So, below you can see that I easily start a guacd container using the 65534:65534 user.
I then try to do the same with the guacamole container, but it fails.
I then start it without the docker _-u_ option, and it flawlessly starts, but the _java_ process runs as root user.
Feel free if you need more test / info to try to sort this out.
Thank you Nick for your support (y)
{color:#4c9aff}{{# docker run --name some-guacd -d {color:#00875a}-u 65534:65534{color} guacamole/guacd:1.1.0-RC1}}{color}
{color:#4c9aff}{{# docker ps -a}}{color}
{{CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES}}
{{e145bb6006a2 guacamole/guacd:1.1.0-RC1 "/bin/sh -c '/usr/lo…" 10 seconds ago {color:#00875a}Up 9 seconds{color} 4822/tcp some-guacd}}
{color:#4c9aff}{{# ps -ef | grep guacd}}{color}
{{{color:#00875a}nobody{color} 21286 21266 0 15:57 ? 00:00:00 /bin/sh -c /usr/local/guacamole/sbin/guacd -b 0.0.0.0 -L $GUACD_LOG_LEVEL -f}}
{{{color:#00875a}nobody{color} 21344 21286 0 15:57 ? 00:00:00 /usr/local/guacamole/sbin/guacd -b 0.0.0.0 -L info -f}}
{color:#4c9aff}{{# docker run --name some-guacamole --link some-guacd:guacd -e MYSQL_HOSTNAME=10.10.10.10 -e MYSQL_DATABASE=guacamole -e MYSQL_USER=guacamole -e MYSQL_PASSWORD='guacamole' -d {color:#00875a}-u 65534:65534{color} -p 127.0.0.1:8080:8080 guacamole/guacamole:1.1.0-RC1}}{color}
{color:#4c9aff}{{# docker ps -a}}{color}
{{CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES}}
{{b0826b7240c0 guacamole/guacamole:1.1.0-RC1 "/opt/guacamole/bin/…" 6 seconds ago {color:#de350b}Exited (1) 4 seconds ago{color} some-guacamole}}
{{e145bb6006a2 guacamole/guacd:1.1.0-RC1 "/bin/sh -c '/usr/lo…" 2 minutes ago Up 2 minutes 4822/tcp some-guacd}}
{color:#4c9aff}{{# docker rm b0826b7240c0}}{color}
{color:#4c9aff}{{# docker run --name some-guacamole --link some-guacd:guacd -e MYSQL_HOSTNAME=10.10.10.10 -e MYSQL_DATABASE=guacamole -e MYSQL_USER=guacamole -e MYSQL_PASSWORD='guacamole' -d -p 127.0.0.1:8080:8080 guacamole/guacamole:1.1.0-RC1}}{color}
{color:#4c9aff}{{# docker ps -a}}{color}
{{CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES}}
{{b7e4d16aa766 guacamole/guacamole:1.1.0-RC1 "/opt/guacamole/bin/…" 13 seconds ago {color:#00875a}Up 13 seconds{color} 127.0.0.1:8080->8080/tcp some-guacamole}}
{{e145bb6006a2 guacamole/guacd:1.1.0-RC1 "/bin/sh -c '/usr/lo…" 3 minutes ago Up 3 minutes 4822/tcp some-guacd}}
{color:#4c9aff}{{# ps -ef | grep java}}{color}
{{{color:#de350b}root{color} 24724 24706 7 16:01 ? 00:00:14 /docker-java-home/jre/bin/java -Djava.util.logging.config.file=/usr/local/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat -Dcatalina.home=/usr/local/tomcat -Djava.io.tmpdir=/usr/local/tomcat/temp org.apache.catalina.startup.Bootstrap start}}
was (Author: jotam):
So, below you can see that I easily start a guacd container using the 65534:65534 user.
I then try to the the same with the guacamole container, but it fails.
I then start it without the docker _-u_ option, and it flawlessly starts, but the _java_ process runs as root user.
Feel free if you need more test / info to try to sort this out.
Thank you Nick for your support (y)
{color:#4c9aff}{{# docker run --name some-guacd -d {color:#00875a}-u 65534:65534{color} guacamole/guacd:1.1.0-RC1}}{color}
{color:#4c9aff}{{# docker ps -a}}{color}
{{CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES}}
{{e145bb6006a2 guacamole/guacd:1.1.0-RC1 "/bin/sh -c '/usr/lo…" 10 seconds ago {color:#00875a}Up 9 seconds{color} 4822/tcp some-guacd}}
{color:#4c9aff}{{# ps -ef | grep guacd}}{color}
{{{color:#00875a}nobody{color} 21286 21266 0 15:57 ? 00:00:00 /bin/sh -c /usr/local/guacamole/sbin/guacd -b 0.0.0.0 -L $GUACD_LOG_LEVEL -f}}
{{{color:#00875a}nobody{color} 21344 21286 0 15:57 ? 00:00:00 /usr/local/guacamole/sbin/guacd -b 0.0.0.0 -L info -f}}
{color:#4c9aff}{{# docker run --name some-guacamole --link some-guacd:guacd -e MYSQL_HOSTNAME=10.10.10.10 -e MYSQL_DATABASE=guacamole -e MYSQL_USER=guacamole -e MYSQL_PASSWORD='guacamole' -d {color:#00875a}-u 65534:65534{color} -p 127.0.0.1:8080:8080 guacamole/guacamole:1.1.0-RC1}}{color}
{color:#4c9aff}{{# docker ps -a}}{color}
{{CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES}}
{{b0826b7240c0 guacamole/guacamole:1.1.0-RC1 "/opt/guacamole/bin/…" 6 seconds ago {color:#de350b}Exited (1) 4 seconds ago{color} some-guacamole}}
{{e145bb6006a2 guacamole/guacd:1.1.0-RC1 "/bin/sh -c '/usr/lo…" 2 minutes ago Up 2 minutes 4822/tcp some-guacd}}
{color:#4c9aff}{{# docker rm b0826b7240c0}}{color}
{color:#4c9aff}{{# docker run --name some-guacamole --link some-guacd:guacd -e MYSQL_HOSTNAME=10.10.10.10 -e MYSQL_DATABASE=guacamole -e MYSQL_USER=guacamole -e MYSQL_PASSWORD='guacamole' -d -p 127.0.0.1:8080:8080 guacamole/guacamole:1.1.0-RC1}}{color}
{color:#4c9aff}{{# docker ps -a}}{color}
{{CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES}}
{{b7e4d16aa766 guacamole/guacamole:1.1.0-RC1 "/opt/guacamole/bin/…" 13 seconds ago {color:#00875a}Up 13 seconds{color} 127.0.0.1:8080->8080/tcp some-guacamole}}
{{e145bb6006a2 guacamole/guacd:1.1.0-RC1 "/bin/sh -c '/usr/lo…" 3 minutes ago Up 3 minutes 4822/tcp some-guacd}}
{color:#4c9aff}{{# ps -ef | grep java}}{color}
{{{color:#de350b}root{color} 24724 24706 7 16:01 ? 00:00:14 /docker-java-home/jre/bin/java -Djava.util.logging.config.file=/usr/local/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027 -Dignore.endorsed.dirs= -classpath /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar -Dcatalina.base=/usr/local/tomcat -Dcatalina.home=/usr/local/tomcat -Djava.io.tmpdir=/usr/local/tomcat/temp org.apache.catalina.startup.Bootstrap start}}
> Guacamole/Guacd Docker Process Privilege Drop
> ---------------------------------------------
>
> Key: GUACAMOLE-890
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-890
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole-docker
> Reporter: Anthony Boccia
> Priority: Minor
> Labels: docker, security
>
> Hello,
> I noticed after deploying Guacamole in docker that the processes all run as the root user. Are there any plans to add support for specifying a user for the processes to drop privs to and run as instead of root? I am currently doing this rebuilding the containers for guacamole and guacd adding in my own user and using docker compose to exec all processes triggered within the container as that user. I feel like the option to specify this should be done upstream.
> Thank You
--
This message was sent by Atlassian Jira
(v8.3.4#803005)