privileged mode not working
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
Research direction
Compare /usr/libexec/s2i/run with /usr/bin/run-httpd and the shared logic in /usr/share/container-scripts/httpd/common.sh, starting with the HTTPD_RUN_BY_S2I and runs_privileged checks. Reproduce the supplied docker command and verify that privileged execution through S2I selects the intended configuration without the Apache root-user error.
Written by the indexing model from the issue text.
Description
Hi,
When I run docker run --rm -u root --cap-add net_bind_service --network=vlan2656 --ip=22.0.56.7 apigw:1.0 I have this error :
AH00526: Syntax error on line 66 of /opt/rh/httpd24/root/etc/httpd/conf/httpd.conf:
Error:\tApache has not been designed to serve pages while\n\trunning as root. There are known race conditions that\n\twill allow any local user to read any file on the system.\n\tIf you still desire to serve pages as root then\n\tadd -DBIG_SECURITY_HOLE to the CFLAGS env variable\n\tand then rebuild the server.\n\tIt is strongly suggested that you instead modify the User\n\tdirective in your httpd.conf file to list a non-root\n\tuser.\n
If I run in debug
bash-4.2# /usr/libexec/s2i/run
+ export HTTPD_RUN_BY_S2I=1
+ HTTPD_RUN_BY_S2I=1
+ exec run-httpd
+ '[' -v HTTPD_RUN_BY_S2I ']'
+ config_non_privileged
If I run manually /usr/bin/run-httpd all is working (privileged mode is detected)
/usr/bin/run-httpd
+ set -eu
+ source /usr/share/container-scripts/httpd//common.sh
++ set -x
+ '[' -v HTTPD_RUN_BY_S2I ']'
+ runs_privileged
++ id -u
+ test 0 == 0
+ return 0
+ config_privileged
I don't understand why we have this test in /usr/bin/run-httpd
if ! [ -v HTTPD_RUN_BY_S2I ] && runs_privileged ; then
and not
if runs_privileged ; then
Also, it should be nice to allow to skip config_general() when running as privileged user or to allow to configure the listening ports via environment variables.
Best regards,
- Dominant language
- Shell
- Stars
- 52
- Forks
- 122
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sclorg/httpd-container
-
Difficulty 1/5 Under an hour Newbie friendliness 45/100
sclorg/httpd-container#255 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
sclorg/httpd-container#232 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
sclorg/httpd-container#226 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
sclorg/httpd-container#169 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 20/100
sclorg/httpd-container#131 ·
All issues in sclorg/httpd-container
Similar issues
-
Update Vish to 1.1.5 Openpackage-update
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
oSoWoSo/vOid_Community_repOsitory#144 · 1 comment ·
-
help wanted new command
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
tldr-pages/tldr#24151 ·
-
PacReq: Rune IDE Openpackage request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pacstall/pacstall-programs#9402 ·
-
[BUG] ci: the first prefetch-images.sh call runs before shard.txt exists, so it is always a no-op Openbug github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
update-request
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
msys2/MINGW-packages#31768 ·