arno/hipchat
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

make hipchat grsec friendly

Browse Source
This commit is contained in:
Andy 2016-05-19 17:18:36 +02:00
parent 407dee53c4
commit b7b8e99e25
Signed by: arno
GPG Key ID: 368DDA2E9A471EAC
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Dockerfile
View File

@ -5,7 +5,7 @@ MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update \
&& apt-get install -yq apt-transport-https wget \
&& apt-get install -yq apt-transport-https wget paxctl \
&& wget -O - https://atlassian.artifactoryonline.com/atlassian/api/gpg/key/public | apt-key add - \
&& echo "deb https://atlassian.artifactoryonline.com/atlassian/hipchat-apt-client $(lsb_release -c -s) main" > /etc/apt/sources.list.d/atlassian-hipchat4.list \
&& apt-get update \
@ -13,6 +13,17 @@ RUN apt-get update \
&& apt-get -fyq install \
&& rm -rf -- /var/lib/apt/lists/*
# Make HipChat grsec friendly
#
# (runtime only, since xattrs are not preserved in Docker's final image)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
# RUN setfattr -n user.pax.flags -v "m" /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
#
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
RUN paxctl -c -v -m /opt/HipChat4/lib/HipChat.bin /opt/HipChat4/lib/QtWebEngineProcess.bin
ENV USER user
ENV UID 1000
ENV GROUPS video