From 2def3f1dac214e3105dbed0a39b67f7e531ad196 Mon Sep 17 00:00:00 2001 From: Adam Outler Date: Fri, 26 Sep 2025 21:01:58 -0400 Subject: [PATCH] Validated launch on runner & hardend --- .devcontainer/Dockerfile | 38 ++++----- .../resources/devcontainer-Dockerfile | 12 +-- .devcontainer/scripts/setup.sh | 24 ++++-- .devcontainer/scripts/start-nginx.sh | 11 +++ .vscode/launch.json | 1 + .vscode/settings.json | 3 + .vscode/tasks.json | 10 ++- Dockerfile | 77 ++++++------------- 8 files changed, 84 insertions(+), 92 deletions(-) create mode 100755 .devcontainer/scripts/start-nginx.sh diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 0dcf480c..48e8ea62 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -79,27 +79,19 @@ RUN apk add --no-cache bash libbsd zip lsblk gettext-envsubst sudo mtr tzdata cu rm -rf /var/cache/apk/* && \ rm -f /etc/nginx/http.d/default.conf -# Install from previous build stage + + +# Install application, copy files, set permissions COPY --from=builder /opt/venv /opt/venv COPY --from=builder /usr/sbin/usermod /usr/sbin/groupmod /usr/sbin/ - -# Simple copy of directory structure instead of individual files or complicated directory structure with RUN mkdir COPY --chown=netalertx:netalertx install/alpine-docker/ / - -RUN chmod -R a+x ${SYSTEM_SERVICES} /build/ /entrypoint.sh && \ - sh -c "find ${NETALERTX_APP} -type d -exec chmod 750 {} \;" && \ - sh -c "find ${NETALERTX_APP} -type f -exec chmod 640 {} \;" && \ - sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) -exec chmod 750 {} \;" - -# Copy source COPY --chown=netalertx:netalertx --chmod=755 back ${NETALERTX_BACK} COPY --chown=netalertx:netalertx --chmod=755 front ${NETALERTX_FRONT} COPY --chown=netalertx:netalertx --chmod=755 server ${NETALERTX_SERVER} -# create folders with netalertx user ownership and 755 permissions -RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} - -# Install runtime dependencies - +RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} && \ + install -d -o netalertx -g netalertx -m 755 ${NETALERTX_LOG} && \ + sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) \ + -exec chmod 750 {} \;" #initialize each service with the dockerfiles/init-*.sh scripts, once. @@ -113,9 +105,7 @@ RUN sh /build/init-nginx.sh && \ # set netalertx to allow sudoers for any command, no password RUN echo "netalertx ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers - - - +ENTRYPOINT ["/bin/sh","-c","sleep infinity"] # Final hardened stage to improve security by setting correct permissions and removing sudo access # When complete, if the image is compromised, there's not much that can be done with it. FROM runner AS hardened @@ -163,13 +153,16 @@ ENTRYPOINT ["/entrypoint.sh"] # Prefer to place dev-only setup here; use setup.sh only for runtime fixes. FROM runner AS netalertx-devcontainer +USER root ENV INSTALL_DIR=/app ENV PYTHONPATH=/workspaces/NetAlertX/test:/workspaces/NetAlertX/server:/app:/app/server:/opt/venv/lib/python3.12/site-packages +ENV HOME=/workspaces COPY .devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini # Install common tools, create user, and set up sudo -RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow +RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow github-cli fish + # Install debugpy in the virtualenv if present, otherwise into system python3 RUN /bin/sh -c '(/opt/venv/bin/python3 -m pip install --no-cache-dir debugpy) || (python3 -m pip install --no-cache-dir debugpy) || true' @@ -177,7 +170,8 @@ RUN /opt/venv/bin/python -m pip install -U pytest pytest-cov USER netalertx -WORKDIR /workspaces/NetAlertX +WORKDIR /workspaces/ +RUN mkdir -p /workspaces && \ + sudo chmod 777 /workspaces - -ENTRYPOINT ["/bin/sh","-c","sleep infinity"] \ No newline at end of file +USER netalertx diff --git a/.devcontainer/resources/devcontainer-Dockerfile b/.devcontainer/resources/devcontainer-Dockerfile index 009b7c8b..fe0eec7c 100755 --- a/.devcontainer/resources/devcontainer-Dockerfile +++ b/.devcontainer/resources/devcontainer-Dockerfile @@ -11,15 +11,11 @@ ENV PYTHONPATH=/workspaces/NetAlertX/test:/workspaces/NetAlertX/server:/app:/app COPY .devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini # Install common tools, create user, and set up sudo -RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov shadow github-cli +RUN apk add --no-cache git nano vim jq php83-pecl-xdebug py3-pip nodejs sudo gpgconf pytest pytest-cov # Install debugpy in the virtualenv if present, otherwise into system python3 RUN /bin/sh -c '(/opt/venv/bin/python3 -m pip install --no-cache-dir debugpy) || (python3 -m pip install --no-cache-dir debugpy) || true' -RUN /opt/venv/bin/python -m pip install -U pytest pytest-cov +RUN sudo /env/bin/python -m pip install -U pytest pytest-cov -USER netalertx - -WORKDIR /workspaces/NetAlertX - - -ENTRYPOINT ["/bin/sh","-c","sleep infinity"] \ No newline at end of file +RUN ["/bin/sh","-c","sleep infinity"] + \ No newline at end of file diff --git a/.devcontainer/scripts/setup.sh b/.devcontainer/scripts/setup.sh index ee98095c..fe282c15 100755 --- a/.devcontainer/scripts/setup.sh +++ b/.devcontainer/scripts/setup.sh @@ -10,7 +10,7 @@ id export APP_DIR="/app" export APP_COMMAND="/workspaces/NetAlertX/.devcontainer/scripts/restart-backend.sh" export PHP_FPM_BIN="/usr/sbin/php-fpm83" -export NGINX_BIN="/usr/sbin/nginx" +export NGINX_BIN="/workspaces/NetAlertX/.devcontainer/scripts/start-nginx.sh" export CROND_BIN="/usr/sbin/crond -f" @@ -33,6 +33,8 @@ export SOURCE_DIR="/workspaces/NetAlertX" main() { echo "=== NetAlertX Development Container Setup ===" echo "Setting up ${SOURCE_DIR}..." + sudo chown $(id -u):$(id -g) /workspaces + sudo chown 755 /workspaces configure_source echo "--- Starting Development Services ---" @@ -75,8 +77,10 @@ configure_source() { sudo cp -R ${SOURCE_DIR}/log/ /tmp/log/ || true sudo cp -R ${SOURCE_DIR}/api/ /tmp/api/ || true sudo mkdir -p ${NETALERTX_API} ${NETALERTX_LOG} - sudo mount -t tmpfs -o size=256M tmpfs "${INSTALL_DIR}/log" - sudo mount -t tmpfs -o size=512M tmpfs "${INSTALL_DIR}/api" + # mount tmpfs with netalertx:netalertx ownership and 775 permissions + sudo mount -o uid=$(id -u netalertx),gid=$(id -g netalertx),mode=775 -t tmpfs -o size=256M tmpfs "${NETALERTX_LOG}" + sudo mount -o uid=$(id -u netalertx),gid=$(id -g netalertx),mode=775 -t tmpfs -o size=256M tmpfs "${NETALERTX_API}" + # mount tmpfs with root:root ownership and 755 permissions sudo cp -R /tmp/log/* ${NETALERTX_LOG} 2>/dev/null || true sudo cp -R /tmp/api/* ${NETALERTX_API} 2>/dev/null || true sudo rm -Rf /tmp/log /tmp/api || true @@ -86,6 +90,7 @@ configure_source() { echo " -> Setting ownership and permissions" + chmod +x /workspaces/NetAlertX/.devcontainer/scripts/start-nginx.sh sudo date +%s > "${INSTALL_DIR}/front/buildtimestamp.txt" @@ -96,6 +101,8 @@ configure_source() { touch ${INSTALL_DIR}/log/stderr.log \ ${INSTALL_DIR}/log/execution_queue.log echo 0>${INSTALL_DIR}/log/db_is_locked.log + mkdir -p /app/log/plugins + sudo chown -R netalertx:www-data ${INSTALL_DIR} date +%s > /app/front/buildtimestamp.txt @@ -141,10 +148,11 @@ start_services() { configure_php() { echo "[2/3] Configuring PHP-FPM..." sudo killall php-fpm83 &>/dev/null || true - install -d -o nginx -g www-data /run/php/ &>/dev/null + install -d -o netalertx -g www-data /run/php/ &>/dev/null sudo sed -i "/^;pid/c\pid = /run/php/php8.3-fpm.pid" /etc/php83/php-fpm.conf sudo sed -i 's|^listen = .*|listen = 127.0.0.1:9000|' /etc/php83/php-fpm.d/www.conf sudo sed -i 's|fastcgi_pass .*|fastcgi_pass 127.0.0.1:9000;|' /etc/nginx/http.d/*.conf + #increase max child process count to 10 sudo sed -i -e 's/pm.max_children = 5/pm.max_children = 10/' /etc/php83/php-fpm.d/www.conf @@ -155,7 +163,7 @@ configure_php() { if ! grep -q '^error_log\s*=' /etc/php83/php-fpm.conf; then echo 'error_log = /app/log/app.php_errors.log' | sudo tee -a /etc/php83/php-fpm.conf fi - + sudo mkdir -p /etc/php83/conf.d sudo cp /workspaces/NetAlertX/.devcontainer/resources/99-xdebug.ini /etc/php83/conf.d/99-xdebug.ini @@ -163,6 +171,12 @@ configure_php() { install -d -o netalertx -g www-data -m 755 var/log/php83; sudo chmod 644 /etc/php83/conf.d/99-xdebug.ini || true + sudo install -d -o netalertx -g www-data -m 775 /run/php + + sudo rm /var/lib/nginx/logs/ && sudo install -d -o netalertx -g www-data /var/lib/nginx/logs/ + sudo rm /var/log/nginx && sudo install -d -o netalertx -g www-data /var/log/nginx + sudo chown -R netalertx:www-data /var/log/nginx + sudo chown -R netalertx:www-data /run/nginx } diff --git a/.devcontainer/scripts/start-nginx.sh b/.devcontainer/scripts/start-nginx.sh new file mode 100755 index 00000000..73f832fd --- /dev/null +++ b/.devcontainer/scripts/start-nginx.sh @@ -0,0 +1,11 @@ + +#create /services/nginx directory for nginx system files +sudo install -d /services/nginx -m 755 -o netalertx -g netalertx +sudo install -d /services/nginx -m 755 -o netalertx -g netalertx +sudo chown -R netalertx:netalertx /var/lib/nginx + +cp /workspaces/NetAlertX/install/alpine-docker/app/services/nginx/nginx.conf /services/nginx/nginx.conf +sed -i 's|/app/services/nginx/netalertx.conf|/services/nginx/netalertx.conf|' /services/nginx/nginx.conf +cp /workspaces/NetAlertX/install/alpine-docker/app/services/nginx/netalertx.conf /services/nginx/netalertx.conf +cp /workspaces/NetAlertX/install/alpine-docker/app/services/nginx/fastcgi_params /services/nginx/fastcgi_params +nginx -c "/services/nginx/nginx.conf" -g "daemon off;" 2>&1 >/app/log/app_front.log \ No newline at end of file diff --git a/.vscode/launch.json b/.vscode/launch.json index 15d4af64..e960c02a 100755 --- a/.vscode/launch.json +++ b/.vscode/launch.json @@ -29,6 +29,7 @@ "pathMappings": { "/app": "${workspaceFolder}" } + } ] } \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json index b3b546f5..eb61ec14 100755 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -10,4 +10,7 @@ "python.defaultInterpreterPath": "/opt/venv/bin/python", // Let the Python extension invoke pytest via the interpreter; avoid hardcoded paths // Removed python.testing.pytestPath and legacy pytest.command overrides + + "terminal.integrated.defaultProfile.linux": "bash", + "terminal.integrated.profiles.linux": { "bash": { "path": "/bin/fish" } } } \ No newline at end of file diff --git a/.vscode/tasks.json b/.vscode/tasks.json index 673a0243..81705106 100755 --- a/.vscode/tasks.json +++ b/.vscode/tasks.json @@ -27,23 +27,25 @@ { "label": "Re-Run Startup Script", "type": "shell", - "command": "${workspaceFolder:NetAlertX}/.devcontainer/scripts/setup.sh", + "command": "test ! -d /workspaces && echo not in container && exit 1; ${workspaceFolder:NetAlertX}/.devcontainer/scripts/setup.sh", "presentation": { "echo": true, "reveal": "always", "panel": "shared", "showReuseMessage": false }, + "problemMatcher": [], "icon": { "id": "beaker", "color": "terminal.ansiBlue" } + }, { "label": "Start Backend (Python)", "type": "shell", - "command": "/workspaces/NetAlertX/.devcontainer/scripts/restart-backend.sh", + "command": "test ! -d /workspaces && echo not in container && exit 1; /workspaces/NetAlertX/.devcontainer/scripts/restart-backend.sh", "presentation": { "echo": true, "reveal": "always", @@ -60,7 +62,7 @@ { "label": "Start Frontend (nginx and PHP-FPM)", "type": "shell", - "command": "killall php-fpm83 nginx 2>/dev/null || true; sleep 1; php-fpm83 & nginx", + "command": "test ! -d /workspaces && echo not in container && exit 1; killall php-fpm83 nginx 2>/dev/null || true; sleep 1; php-fpm83 & nginx", "presentation": { "echo": true, "reveal": "always", @@ -77,7 +79,7 @@ { "label": "Stop Frontend & Backend Services", "type": "shell", - "command": "pkill -f 'php-fpm83|nginx|crond|python3' || true", + "command": "test ! -d /workspaces && echo not in container && exit 1; pkill -f 'php-fpm83|nginx|crond|python3' || true", "presentation": { "echo": true, "reveal": "always", diff --git a/Dockerfile b/Dockerfile index a0fb592e..ecf9f211 100755 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,5 @@ -# Builder stage performs venv creation and installs some tools which are not needed in the final image. -# By separating the image, we are able to discard build tools and reduce the final image size. FROM alpine:3.22 AS builder - ARG INSTALL_DIR=/app ENV PYTHONUNBUFFERED=1 @@ -14,8 +11,6 @@ RUN apk add --no-cache bash shadow python3 python3-dev gcc musl-dev libffi-dev o # Enable venv ENV PATH="/opt/venv/bin:$PATH" - - RUN pip install openwrt-luci-rpc asusrouter asyncio aiohttp graphene flask flask-cors unifi-sm-api tplink-omada-client wakeonlan pycryptodome requests paho-mqtt scapy cron-converter pytz json2table dhcp-leases pyunifi speedtest-cli chardet python-nmap dnspython librouteros yattag zeroconf git+https://github.com/foreign-sub/aiofreepybox.git @@ -23,18 +18,10 @@ RUN pip install openwrt-luci-rpc asusrouter asyncio aiohttp graphene flask flask # The runner is used for both devcontainer, and as a base for the hardened stage. FROM alpine:3.22 AS runner -RUN addgroup -g 20211 netalertx && \ - adduser -u 20211 -G netalertx -D -h /app netalertx - ARG INSTALL_DIR=/app - -# Enable venv ENV PATH="/opt/venv/bin:/usr/bin:/sbin:/bin:$PATH" - - -ENV PORT=20211 LISTEN_ADDR=0.0.0.0 GRAPHQL_PORT=20212 # NetAlertX app directories ENV NETALERTX_APP=/app ENV NETALERTX_CONFIG=${NETALERTX_APP}/config @@ -70,34 +57,27 @@ ENV PHP_FPM_CONFIG_FILE=/etc/php83/php-fpm.conf ENV PHP_WWW_CONF_FILE=/etc/php83/php-fpm.d/www.conf ENV SYSTEM_SERVICES=/services +#Create netalertx user and group +RUN addgroup -g 20211 netalertx && \ + adduser -u 20211 -G netalertx -D -h /app netalertx + RUN apk add --no-cache bash libbsd zip lsblk gettext-envsubst sudo mtr tzdata curl arp-scan iproute2 \ iproute2-ss nmap nmap-scripts traceroute nbtscan openrc dbus net-tools net-snmp-tools bind-tools awake \ ca-certificates sqlite php83 php83-fpm php83-cgi php83-curl php83-sqlite3 php83-session python3 nginx sudo && \ rm -rf /var/cache/apk/* && \ rm -f /etc/nginx/http.d/default.conf -# Install from previous build stage +# Install application, copy files, set permissions COPY --from=builder /opt/venv /opt/venv COPY --from=builder /usr/sbin/usermod /usr/sbin/groupmod /usr/sbin/ - -# Simple copy of directory structure instead of individual files or complicated directory structure with RUN mkdir COPY --chown=netalertx:netalertx install/alpine-docker/ / - -RUN chmod -R a+x ${SYSTEM_SERVICES} /build/ /entrypoint.sh && \ - sh -c "find ${NETALERTX_APP} -type d -exec chmod 750 {} \;" && \ - sh -c "find ${NETALERTX_APP} -type f -exec chmod 640 {} \;" && \ - sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) -exec chmod 750 {} \;" - -# Copy source COPY --chown=netalertx:netalertx --chmod=755 back ${NETALERTX_BACK} COPY --chown=netalertx:netalertx --chmod=755 front ${NETALERTX_FRONT} COPY --chown=netalertx:netalertx --chmod=755 server ${NETALERTX_SERVER} -# create folders with netalertx user ownership and 755 permissions -RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} - -# Install runtime dependencies - - +RUN install -d -o netalertx -g netalertx -m 755 ${NETALERTX_API} && \ + install -d -o netalertx -g netalertx -m 755 ${NETALERTX_LOG} && \ + sh -c "find ${NETALERTX_APP} -type f \( -name '*.sh' -o -name 'speedtest-cli' \) \ + -exec chmod 750 {} \;" #initialize each service with the dockerfiles/init-*.sh scripts, once. RUN sh /build/init-nginx.sh && \ @@ -106,19 +86,15 @@ RUN sh /build/init-nginx.sh && \ sh /build/init-backend.sh && \ rm -rf /build/* - # set netalertx to allow sudoers for any command, no password RUN echo "netalertx ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers -RUN date +%s > ${INSTALL_DIR}/front/buildtimestamp.txt - - +ENTRYPOINT ["/bin/sh","-c","sleep infinity"] # Final hardened stage to improve security by setting correct permissions and removing sudo access # When complete, if the image is compromised, there's not much that can be done with it. FROM runner AS hardened - # create readonly user and group with no shell access RUN addgroup -g 20212 readonly && \ adduser -u 20212 -G readonly -D -h /app readonly @@ -126,28 +102,23 @@ RUN addgroup -g 20212 readonly && \ # remove netalertx from sudoers RUN sh -c "sed -i '/netalertx ALL=(ALL) NOPASSWD: ALL/d' /etc/sudoers" -RUN chown -R readonly:readonly ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} ${NETALERTX_SERVICES} -RUN chmod -R 004 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} -RUN chmod 005 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} -RUN chmod -R 005 ${SYSTEM_SERVICES} ${NETALERTX_SERVICES} - -RUN chown -R netalertx:netalertx ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \ +RUN chown -R readonly:readonly ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} ${NETALERTX_SERVICES} && \ + chmod -R 004 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} && \ + chmod 005 ${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} && \ + chmod -R 005 ${SYSTEM_SERVICES} ${NETALERTX_SERVICES} && \ + chown -R netalertx:netalertx ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} && \ chmod -R 600 ${NETALERTX_CONFIG} ${NETALERTX_DB} {NETALERTX_API} ${NETALERTX_LOG} && \ - chmod 700 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} ${NETALERTX_PLUGINS_LOG} - - -RUN chown readonly:readonly / -RUN chown -R netalertx:netalertx /var/log/nginx /var/lib/nginx /run -RUN echo -ne '#!/bin/bash\nexit 0\n' > /usr/bin/sudo && chmod +x /usr/bin/sudo - -RUN find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o -path /run -prune -o -path /var/log -prune -o -path /tmp -prune -o -group 0 -o -user 0 -exec chown readonly:readonly {} + - + chmod 700 ${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} ${NETALERTX_PLUGINS_LOG} && \ + chown readonly:readonly / && \ + chown -R netalertx:netalertx /var/log/nginx /var/lib/nginx /run && \ + echo -ne '#!/bin/bash\nexit 0\n' > /usr/bin/sudo && chmod +x /usr/bin/sudo && \ + find / -path /proc -prune -o -path /sys -prune -o -path /dev -prune -o \ + -path /run -prune -o -path /var/log -prune -o -path /tmp -prune -o \ + -group 0 -o -user 0 -exec chown readonly:readonly {} + USER netalertx HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \ -CMD /usr/local/bin/healthcheck.sh - -ENTRYPOINT ["/entrypoint.sh"] - + CMD /usr/local/bin/healthcheck.sh +ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file