Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

privileged mode not working #70

Open
Poil opened this issue Nov 14, 2018 · 0 comments
Open

privileged mode not working #70

Poil opened this issue Nov 14, 2018 · 0 comments

Comments

@Poil
Copy link

Poil commented Nov 14, 2018

Hi,

When I run docker run --rm -u root --cap-add net_bind_service --network=vlan2656 --ip=22.0.56.7 apigw:1.0 I have this error :

AH00526: Syntax error on line 66 of /opt/rh/httpd24/root/etc/httpd/conf/httpd.conf:
Error:\tApache has not been designed to serve pages while\n\trunning as root.  There are known race conditions that\n\twill allow any local user to read any file on the system.\n\tIf you still desire to serve pages as root then\n\tadd -DBIG_SECURITY_HOLE to the CFLAGS env variable\n\tand then rebuild the server.\n\tIt is strongly suggested that you instead modify the User\n\tdirective in your httpd.conf file to list a non-root\n\tuser.\n

If I run in debug

bash-4.2# /usr/libexec/s2i/run
+ export HTTPD_RUN_BY_S2I=1
+ HTTPD_RUN_BY_S2I=1
+ exec run-httpd
+ '[' -v HTTPD_RUN_BY_S2I ']'
+ config_non_privileged

If I run manually /usr/bin/run-httpd all is working (privileged mode is detected)

 /usr/bin/run-httpd 
+ set -eu
+ source /usr/share/container-scripts/httpd//common.sh
++ set -x
+ '[' -v HTTPD_RUN_BY_S2I ']'
+ runs_privileged
++ id -u
+ test 0 == 0
+ return 0
+ config_privileged

I don't understand why we have this test in /usr/bin/run-httpd

if ! [ -v HTTPD_RUN_BY_S2I ] && runs_privileged ; then

and not

if runs_privileged ; then

Also, it should be nice to allow to skip config_general() when running as privileged user or to allow to configure the listening ports via environment variables.

Best regards,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant