arno/keepass2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

add info about the grsec workarounds

Browse Source
This commit is contained in:
Andy 2016-05-19 17:43:22 +02:00
parent 3098181437
commit b2f2d3a429
Signed by: arno
GPG Key ID: 368DDA2E9A471EAC
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Dockerfile
View File

@ -9,6 +9,13 @@ RUN apt-get install -yq keepass2 xdotool paxctl \
&& rm -rf /var/lib/apt/lists && rm -rf /var/lib/apt/lists
# make KeePass2 grsec friendly # make KeePass2 grsec friendly
#
# To build the Docker image, I currently had to disable the following grsec protections:
# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
# kernel.grsecurity.chroot_deny_chmod = 0
# kernel.grsecurity.chroot_deny_mknod = 0
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
#
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping> # m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
# (runtime only, since xattrs are not preserved in Docker's final image) # (runtime only, since xattrs are not preserved in Docker's final image)
# RUN setfattr -n user.pax.flags -v "m" /usr/bin/mono-sgen # RUN setfattr -n user.pax.flags -v "m" /usr/bin/mono-sgen