Run all processes with seluser instead of root #477

diemol · 2017-05-02T15:00:18Z

While checking #474, I found that in some images the processes are run by seluser and in other ones they are run with seluser and root (specially in the debug ones). E.g.:

docker run --rm -p 4444:4444 -p 5900:5900 -v /dev/shm:/dev/shm --shm-size=1g selenium/standalone-chrome-debug:3.4.0-chromium

docker exec -ti objective_stonebraker bash

root@be3eb04ea476:/# ps -aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1  20996  3280 ?        Ss+  14:44   0:00 /bin/bash /opt/bin/entry_point.sh
root        21  0.0  0.0  20992  1616 ?        S+   14:44   0:00 /bin/bash /opt/bin/entry_point.sh
root        26  0.0  0.0   4508  1632 ?        S+   14:44   0:00 /bin/sh /usr/bin/xvfb-run -n 99 --server-args=-screen 0 1360x1020x24 -ac +extension RANDR java -jar /opt/selenium/se
root        38  0.8  2.6 217096 54464 ?        Sl+  14:44   0:00 Xvfb :99 -screen 0 1360x1020x24 -ac +extension RANDR -nolisten tcp -auth /tmp/xvfb-run.l7EYS6/Xauthority
root        43  3.0  2.3 2966204 48284 ?       Sl+  14:44   0:01 java -jar /opt/selenium/selenium-server-standalone.jar
root        56  1.8  0.5 114212 10972 ?        S+   14:44   0:00 fluxbox -display :99.0
root        57  0.2  0.6 113380 13536 ?        S+   14:44   0:00 x11vnc -forever -usepw -shared -rfbport 5900 -display :99.0
root        78  1.0  0.1  21196  3672 ?        Ss   14:45   0:00 bash
root        87  0.0  0.1  37364  3276 ?        R+   14:45   0:00 ps -aux

I went through all the Dockerfiles and entry_point.sh and improved them so all the processes run now with seluser.

I executed the tests and they passed, I also tested it so the fix done in #459 and #469 don't get lost.

@ddavison
I will add some comments next to the commits to make this PR easier to review.

@elgalu, can you please also help to review this PR?

By placing an X in the preceding checkbox, I verify that I have signed the Contributor License Agreement

…ome user folder.

…on root.

…nds as seluser

…luser, not needed anymore

…hey already exist in the seluser env. Also adopting new paths.

… up the build and reduces duplicated config.

diemol · 2017-05-02T15:02:18Z

Base/Dockerfile

+#==========
+RUN  mkdir -p /home/seluser/selenium \
+  && wget --no-verbose https://selenium-release.storage.googleapis.com/3.4/selenium-server-standalone-3.4.0.jar \
+    -O /home/seluser/selenium/selenium-server-standalone.jar


The Selenium related files are placed in a seluser home subfolder, called /home/seluser/selenium/, so the seluser is owner by default.

diemol · 2017-05-02T15:03:35Z

Hub/Dockerfile.txt

@@ -1,3 +1,5 @@
+USER seluser
+


Running all commands as seluser, so the ENV vars a present for this user always.

diemol · 2017-05-02T15:04:32Z

Makefile

@@ -61,7 +61,7 @@ standalone_firefox: generate_standalone_firefox firefox
 	cd ./StandaloneFirefox && docker build $(BUILD_ARGS) -t $(NAME)/standalone-firefox:$(VERSION) .

 generate_standalone_firefox_debug:
-	cd ./StandaloneDebug && ./generate.sh StandaloneFirefoxDebug standalone-firefox Firefox $(VERSION) $(NAMESPACE) $(AUTHORS)
+	cd ./StandaloneDebug && ./generate.sh StandaloneFirefoxDebug node-firefox-debug Firefox $(VERSION) $(NAMESPACE) $(AUTHORS)


Building the StandaloneDebug images based on the NodeDebug images, makes the build faster.

diemol · 2017-05-02T15:08:21Z

NodeBase/Dockerfile.txt

+ENV NODE_APPLICATION_NAME ""
+
+# Following line fixes https://github.com/SeleniumHQ/docker-selenium/issues/87
+ENV DBUS_SESSION_BUS_ADDRESS=/dev/null


Leaving these ENV vars in the NodeBase image, they were duplicated in other docker files.
Exporting them with seluser, so they are present by default in the entry points.

diemol · 2017-05-02T15:13:23Z

NodeChromeDebug/entry_point.sh

-env | cut -f 1 -d "=" | sort > asroot
-  sudo -E -u seluser -i env | cut -f 1 -d "=" | sort > asseluser
-  sudo -E -i -u seluser \
-  "$(for E in $(grep -vxFf asseluser asroot); do echo $E=$(eval echo \$$E); done)" \


This was a workaround to export the ENV vars present in the root user and not present in the seluser. Since all ENV vars are now exported with the seluser, this is not needed anymore.

diemol · 2017-05-02T15:14:36Z

NodeDebug/entry_point.sh

+#!/bin/bash
+#
+# IMPORTANT: Change this file only in directory NodeDebug!
+


File added to handle the entry_point.sh in the same way it is done for the StandaloneDebug images. Things get changed here and the file is copied to the appropriate folders.

diemol · 2017-05-02T15:15:10Z

NodeFirefox/Dockerfile.txt

@@ -27,31 +27,11 @@ RUN wget --no-verbose -O /tmp/geckodriver.tar.gz https://github.com/mozilla/geck
  && chmod 755 /opt/geckodriver-$GECKODRIVER_VERSION \
  && ln -fs /opt/geckodriver-$GECKODRIVER_VERSION /usr/bin/geckodriver

-#========================


All these ENV vars are now exported in the NodeBase image.

diemol · 2017-05-02T15:15:52Z

NodeFirefoxDebug/Dockerfile.txt

@@ -1,55 +0,0 @@
-FROM selenium/node-firefox:3.4.0-chromium


This file was in the repo, but not used anywhere. The Dockerfile comes from the NodeDebug folder.

diemol · 2017-05-02T15:18:24Z

NodeFirefoxDebug/entry_point.sh

-  sudo -E -u seluser -i env | cut -f 1 -d "=" | sort > asseluser
-  sudo -E -i -u seluser \
-  "$(for E in $(grep -vxFf asseluser asroot); do echo $E=$(eval echo \$$E); done)" \
-  DISPLAY=$DISPLAY \


This was a workaround to export the ENV vars present in the root user and not present in the seluser. Since all ENV vars are now exported with the seluser, this is not needed anymore.

diemol · 2017-05-02T16:00:56Z

NodeBase/entry_point.sh

@@ -29,19 +29,17 @@ if [ ! -z "$SE_OPTS" ]; then
  echo "appending selenium options: ${SE_OPTS}"
 fi

-# TODO: Look into http://www.seleniumhq.org/docs/05_selenium_rc.jsp#browser-side-logs
-


Removing this TODO since the browserSideLog (which the URL refers to), should not be used anymore according to the Selenium Grid code

elgalu · 2017-05-04T17:56:07Z

👍 on my side, I run a couple of tests in my OSX host and also in my Linux host, using chrome and firefox standalone images built from Diego's fork.

ddavison · 2017-05-04T17:58:48Z

i'd like to merge this in at the same time as i get the new testing in place. working on it as we speak, so hopefully soon we'll get this in :)

ddavison · 2017-06-06T16:59:34Z

the only thing that concerns me with these changes, are programs that have their own arbitrary user for security purposes, e.g.: OpenShift. We can fix these on an adhoc basis, but we can probably expect to see some issues being created regarding this.

diemol added 14 commits May 1, 2017 11:21

Setting env var for docker build, plus leaving selenium files under h…

ca4da7a

…ome user folder.

Running commands as seluser instead of root.

553df4e

Running commands as seluser

c8064de

Setting file permissions, env vars as seluser executing commands as n…

4369255

…on root.

Refactoring common config for Chrome and Firefox nodes, running comma…

e39dcc7

…nds as seluser

File not being used, Dockerfile is taken from NodeDebug folder

17e0cc1

Creating VNC pwd as seluser so the service can be run with that user.

ec6c705

Using new paths and removing logic to export env vars from root to se…

b6ada51

…luser, not needed anymore

Central entry_point.sh for the debug images

0304487

Adopting new path and using seluser from the beginning

303e571

Adding note about which file to modify.

02c909e

Removing unneeded logic to copy env vars from root to seluser since t…

225fb30

…hey already exist in the seluser env. Also adopting new paths.

Generating StandaloneDebug images from NodeDebug images, which speeds…

f61783b

… up the build and reduces duplicated config.

Fixing path for PhantomJS build.

b0a1991

diemol commented May 2, 2017

View reviewed changes

diemol added 2 commits May 2, 2017 23:34

Switching back to the previous Selenium files path.

0f12883

Switching back to the previous Selenium files path (2)

cff3315

diemol mentioned this pull request May 2, 2017

selenium/standalone-chrome-debug:3.4.0-bismuth startup issue (and likely all others that have source selenv) #474

Closed

diemol mentioned this pull request May 11, 2017

Firefox ignores desiredCapabilities proxy settings #478

Closed

diemol mentioned this pull request May 28, 2017

Unable to pass -firefoxProfileTemplate via SE_OPTS to standalone-selenium-firefox #489

Closed

ddavison merged commit a032128 into SeleniumHQ:master Jun 6, 2017

navels mentioned this pull request Jul 24, 2017

VNC Password is Undefined #524

Closed

ddavison mentioned this pull request Sep 13, 2018

Support Arbitrary User IDs for OpenShift #787

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Run all processes with seluser instead of root #477

Run all processes with seluser instead of root #477

Uh oh!

diemol commented May 2, 2017

Uh oh!

diemol May 2, 2017 •

edited

Loading

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017 •

edited

Loading

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017

Uh oh!

diemol May 2, 2017

Uh oh!

elgalu commented May 4, 2017

Uh oh!

ddavison commented May 4, 2017

Uh oh!

ddavison commented Jun 6, 2017

Uh oh!

Uh oh!

Uh oh!

Run all processes with seluser instead of root #477

Run all processes with seluser instead of root #477

Uh oh!

Conversation

diemol commented May 2, 2017

Uh oh!

diemol May 2, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

diemol May 2, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elgalu commented May 4, 2017

Uh oh!

ddavison commented May 4, 2017

Uh oh!

ddavison commented Jun 6, 2017

Uh oh!

Uh oh!

diemol May 2, 2017 •

edited

Loading

diemol May 2, 2017 •

edited

Loading