make mps-youtube grsec friendly

Dockerfile

@@ -2,7 +2,7 @@ FROM ubuntu:xenial
 MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
 
 RUN apt-get update && \
-    apt-get -y install python3 virtualenv mpv
+    apt-get -y install python3 virtualenv mpv paxctl
 
 # Workaround: pulseaudio client library likes to remove /dev/shm/pulse-shm-*
 #             files created by the host, causing sound to stop working.
@@ -16,15 +16,33 @@ ENV GROUPS audio
 ENV HOME /home/$USER
 RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER
 
-USER $USER
-WORKDIR $HOME
-
+WORKDIR /opt
 RUN virtualenv -p python3 venv && \
     . venv/bin/activate && \
     pip install --upgrade pip && \
     pip install mps-youtube youtube-dl && \
-    deactivate &&\
-    mkdir $HOME/.config
+    deactivate
+
+# Make mps-youtube grsec friendly
+# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Firefox_.28or_Iceweasel_in_Debian.29
+#
+# To build the Docker image, I currently had to disable the following grsec protections:
+# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
+# kernel.grsecurity.chroot_deny_chmod = 0
+# kernel.grsecurity.chroot_deny_mknod = 0
+# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
+#
+# (runtime only, since xattrs are not preserved in Docker's final image)
+# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
+# RUN setfattr -n user.pax.flags -v "m" /opt/venv/bin/python3
+#
+# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
+# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
+RUN paxctl -c -v -m /opt/venv/bin/python3
+
+USER $USER
+WORKDIR $HOME
+RUN mkdir .config
 
 VOLUME [ "/tmp", "$HOME/.config" ]
-ENTRYPOINT [ "./venv/bin/mpsyt" ]
+ENTRYPOINT [ "/opt/venv/bin/mpsyt" ]