From 66090775ffddb2ae12f88269c5663f153f822fae Mon Sep 17 00:00:00 2001
From: Andrey Arapov <andrey.arapov@nixaid.com>
Date: Wed, 14 Dec 2016 10:25:24 +0100
Subject: [PATCH] refactor

---
 Dockerfile | 34 +++-------------------------------
 launch     |  9 +++++++++
 2 files changed, 12 insertions(+), 31 deletions(-)
 create mode 100644 launch

diff --git a/Dockerfile b/Dockerfile
index df6c01d..61df80e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,7 +7,7 @@ ENV DEBIAN_FRONTEND noninteractive
 
 # Install GTK, pulseaudio and fonts
 RUN apt-get update && \
-    apt-get install -y libcanberra-gtk-module libexif12 pulseaudio paxctl \
+    apt-get install -y libcanberra-gtk-module libexif12 pulseaudio attr \
                        fonts-dejavu-core fonts-freefont-ttf fonts-guru-extra \
                        fonts-kacst fonts-kacst-one fonts-khmeros-core fonts-lao \
                        fonts-liberation fonts-lklug-sinhala fonts-lohit-guru \
@@ -44,25 +44,6 @@ RUN sh -c 'dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
 #             in read-only mode when starting the container.
 RUN echo "enable-shm = no" >> /etc/pulse/client.conf
 
-
-# Make Google Chrome grsec friendly
-# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Google_Chrome_15.0.874.106
-#
-# To build the Docker image, I currently had to disable the following grsec protections:
-# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
-# kernel.grsecurity.chroot_deny_chmod = 0
-# kernel.grsecurity.chroot_deny_mknod = 0
-# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
-#
-# (runtime only, since xattrs are not preserved in Docker's final image)
-# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
-# RUN setfattr -n user.pax.flags -v "m" /opt/google/chrome/chrome
-#
-# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
-# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
-RUN paxctl -c -v -m /opt/google/chrome/chrome
-
-
 ENV USER user
 ENV GROUPS video,audio
 ENV UID 1000
@@ -71,16 +52,7 @@ ENV HOME /home/$USER
 RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER && \
     su -s /bin/sh -l $USER -c 'mkdir -p $HOME/.pki/nssdb $HOME/.local'
 
-USER $USER
 WORKDIR $HOME
 
-# Ephemeral volumes which will live as long as the container exists
-VOLUME [ "$HOME/.pki/nssdb", \
-         "$HOME/.local", \
-         "/tmp", \
-         "/data" ]
-# If you wish to have persistent volumes, then specify them in the docker-compose.yml
-# file at the `volumes:` section or with `-v` when using the `docker run` command
-
-ENTRYPOINT [ "/usr/bin/google-chrome", "--user-data-dir=/data" ]
-# "--no-sandbox"
+COPY launch /launch
+ENTRYPOINT [ "sh", "/launch" ]
diff --git a/launch b/launch
new file mode 100644
index 0000000..7f9382e
--- /dev/null
+++ b/launch
@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+
+mkdir /data $HOME/.pki/nssdb $HOME/.local 2>/dev/null
+chown -Rh $USER:$USER /data $HOME/.pki/nssdb $HOME/.local
+
+# Befriend with grsecurity patched kernel
+setfattr -n user.pax.flags -v m /opt/google/chrome/chrome
+
+su -s /bin/sh -c "/usr/bin/google-chrome --user-data-dir=/data $@" $USER