MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 12:52:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: support dropping privileges with arbitrary users (#18386)

Browse Source 
fixes #18380
This commit is contained in:
Harshavardhana
2023-11-03 14:18:18 -07:00
committed by GitHub
parent da95a2d13f
commit 3c2e1a87e2
7 changed files with 22 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
dockerscripts/docker-entrypoint.sh
View File

@@ -8,22 +8,19 @@ if [ "${1}" != "minio" ]; then
fi
fi
# su-exec to requested user, if service cannot run exec will fail.
docker_switch_user() {
if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
groupadd -f -g "$MINIO_GID" "$MINIO_GROUPNAME" &&
useradd -u "$MINIO_UID" -g "$MINIO_GROUPNAME" "$MINIO_USERNAME"
chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
else
groupadd -f "$MINIO_GROUPNAME" &&
useradd -g "$MINIO_GROUPNAME" "$MINIO_USERNAME"
echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
fi
exec setpriv --reuid="${MINIO_USERNAME}" \
--regid="${MINIO_GROUPNAME}" --keep-groups "$@"
else
exec "$@"
fi
}
## Switch to user if applicable.
## DEPRECATED and unsupported - switch to user if applicable.
docker_switch_user "$@"