Merge pull request #645 from splunk/develop

Release 9.2.0.1

Makefile

@@ -7,8 +7,8 @@ SPLUNK_ANSIBLE_BRANCH ?= develop
 SPLUNK_COMPOSE ?= cluster_absolute_unit.yaml
 # Set Splunk version/build parameters here to define downstream URLs and file names
 SPLUNK_PRODUCT := splunk
-SPLUNK_VERSION := 9.2.0
-SPLUNK_BUILD := 1fff88043d5f
+SPLUNK_VERSION := 9.2.0.1
+SPLUNK_BUILD := d8ae995bf219
 ifeq ($(shell arch), s390x)
 	SPLUNK_ARCH = s390x
 else

docs/CHANGELOG.md

@@ -10,6 +10,7 @@ Red Hat images will continue to be published.
 
 ## Navigation
 
+* [9.2.0.1](#9201)
 * [9.2.0](#920)
 * [9.1.3](#913)
 * [9.1.2](#912)
@@ -99,6 +100,20 @@ Red Hat images will continue to be published.
 
 ---
 
+## 9.2.0.1
+
+#### What's New?
+* Releasing new images to support Splunk Enterprise release.
+
+#### docker-splunk changes:
+* Bumping Splunk version. For details, see [Fixed issues for 9.2.0.1](https://docs.splunk.com/Documentation/Splunk/9.2.0.1/ReleaseNotes/Fixedissues#Splunk_Enterprise_9.2.0.1)
+
+#### splunk-ansible changes:
+* Docs updated
+* Bugfixes
+
+---
+
 ## 9.2.0
 
 #### What's New?

splunk/common-files/entrypoint.sh

@@ -67,6 +67,9 @@ watch_for_failure(){
 		echo Ansible playbook complete, will begin streaming ${SPLUNK_TAIL_FILE}
 		${RUN_AS_SPLUNK} tail -n 0 -f ${SPLUNK_TAIL_FILE} &
 	fi
+	if [[ "$DISABLE_ENTIRE_SHELL_ACCESS" == "true" ]]; then
+		disable_entire_shell_access_for_container
+	fi
 	wait
 }
 
@@ -90,6 +93,12 @@ start() {
 	watch_for_failure
 }
 
+secure_start() {
+    start_and_exit
+    export DISABLE_ENTIRE_SHELL_ACCESS="true"
+    watch_for_failure
+}
+
 configure_multisite() {
 	prep_ansible
 	ansible-playbook $ANSIBLE_EXTRA_FLAGS -i inventory/environ.py -l localhost multisite.yml
@@ -103,6 +112,16 @@ restart(){
 	watch_for_failure
 }
 
+disable_entire_shell_access_for_container() {
+	if [[ "$DISABLE_ENTIRE_SHELL_ACCESS" == "true" ]]; then
+		bash -c "sudo usermod -s /sbin/nologin splunk"
+		bash -c "sudo usermod -s /sbin/nologin ansible"
+		sudo rm /bin/sh
+		sudo rm /bin/bash
+		sudo ln -s /bin/busybox /bin/sh
+	fi
+}
+
 user_permission_change(){
 	if [[ "$STEPDOWN_ANSIBLE_USER" == "true" ]]; then
 		bash -c "sudo deluser -q ansible sudo"
@@ -175,6 +194,10 @@ case "$1" in
 		tail -n 0 -f /etc/hosts &
 		wait
 		;;
+	secure-start|secure-start-service)
+		shift
+		secure_start $@
+		;;
 	bash|splunk-bash)
 		/bin/bash --init-file ${SPLUNK_HOME}/bin/setSplunkEnv
 		;;