arno/mps-youtube
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

make mps-youtube grsec friendly

Browse Source
This commit is contained in:
Andy 2016-05-20 10:18:13 +02:00
parent 011dd1b8ab
commit b9648d0435
Signed by: arno
GPG Key ID: 368DDA2E9A471EAC
1 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
Dockerfile
View File

@ -2,7 +2,7 @@ FROM ubuntu:xenial
MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com> MAINTAINER Andrey Arapov <andrey.arapov@nixaid.com>
RUN apt-get update && \ RUN apt-get update && \
apt-get -y install python3 virtualenv mpv apt-get -y install python3 virtualenv mpv paxctl
# Workaround: pulseaudio client library likes to remove /dev/shm/pulse-shm-* # Workaround: pulseaudio client library likes to remove /dev/shm/pulse-shm-*
# files created by the host, causing sound to stop working. # files created by the host, causing sound to stop working.
@ -16,15 +16,33 @@ ENV GROUPS audio
ENV HOME /home/$USER ENV HOME /home/$USER
RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER RUN useradd -u $UID -m -d $HOME -s /usr/sbin/nologin -G $GROUPS $USER
USER $USER WORKDIR /opt
WORKDIR $HOME
RUN virtualenv -p python3 venv && \ RUN virtualenv -p python3 venv && \
. venv/bin/activate && \ . venv/bin/activate && \
pip install --upgrade pip && \ pip install --upgrade pip && \
pip install mps-youtube youtube-dl && \ pip install mps-youtube youtube-dl && \
deactivate &&\ deactivate
mkdir $HOME/.config
# Make mps-youtube grsec friendly
# more info: https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Firefox_.28or_Iceweasel_in_Debian.29
#
# To build the Docker image, I currently had to disable the following grsec protections:
# # grep -E "chroot_deny_chmod|chroot_deny_mknod|chroot_caps" /etc/sysctl.d/grsec.conf
# kernel.grsecurity.chroot_deny_chmod = 0
# kernel.grsecurity.chroot_deny_mknod = 0
# kernel.grsecurity.chroot_caps = 0 (relates to a systemd package)
#
# (runtime only, since xattrs are not preserved in Docker's final image)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
# RUN setfattr -n user.pax.flags -v "m" /opt/venv/bin/python3
#
# (permanent change, by converting the binary headers PT_GNU_STACK into PT_PAX_FLAGS)
# m: Disable MPROTECT // grsec: denied RWX mmap of <anonymous mapping>
RUN paxctl -c -v -m /opt/venv/bin/python3
USER $USER
WORKDIR $HOME
RUN mkdir .config
VOLUME [ "/tmp", "$HOME/.config" ] VOLUME [ "/tmp", "$HOME/.config" ]
ENTRYPOINT [ "./venv/bin/mpsyt" ] ENTRYPOINT [ "/opt/venv/bin/mpsyt" ]