From b89a44d0ec535209b08a9644f995619fa0428c50 Mon Sep 17 00:00:00 2001 From: Adam Outler Date: Thu, 30 Oct 2025 21:05:24 +0000 Subject: [PATCH] Improve startup checks --- .devcontainer/Dockerfile | 6 +++-- .../entrypoint.d/0-storage-permission.sh | 0 .../entrypoint.d/10-mounts.py | 3 +++ .../entrypoint.d/30-writable-config.sh | 0 .../entrypoint.d/90-excessive-capabilities.sh | 27 +++++++++++++++++++ .../entrypoint.d/95-appliance-integrity.sh | 15 +++++++++++ 6 files changed, 49 insertions(+), 2 deletions(-) mode change 100644 => 100755 install/production-filesystem/entrypoint.d/0-storage-permission.sh mode change 100644 => 100755 install/production-filesystem/entrypoint.d/30-writable-config.sh create mode 100755 install/production-filesystem/entrypoint.d/90-excessive-capabilities.sh create mode 100755 install/production-filesystem/entrypoint.d/95-appliance-integrity.sh diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 21b25760..b0e8b111 100755 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -72,11 +72,13 @@ ENV LOG_STDOUT=${NETALERTX_LOG}/stdout.log ENV LOG_CROND=${NETALERTX_LOG}/crond.log # System Services configuration files +ENV ENTRYPOINT_CHECKS=/entrypoint.d ENV SYSTEM_SERVICES=/services ENV SYSTEM_SERVICES_SCRIPTS=${SYSTEM_SERVICES}/scripts ENV SYSTEM_SERVICES_CONFIG=${SYSTEM_SERVICES}/config ENV SYSTEM_NGINX_CONFIG=${SYSTEM_SERVICES_CONFIG}/nginx ENV SYSTEM_NGINX_CONFIG_FILE=${SYSTEM_NGINX_CONFIG}/nginx.conf +ENV SYSTEM_SERVICES_ACTIVE_CONFIG=${SYSTEM_NGINX_CONFIG}/conf.active ENV SYSTEM_SERVICES_PHP_FOLDER=${SYSTEM_SERVICES_CONFIG}/php ENV SYSTEM_SERVICES_PHP_FPM_D=${SYSTEM_SERVICES_PHP_FOLDER}/php-fpm.d ENV SYSTEM_SERVICES_CROND=${SYSTEM_SERVICES_CONFIG}/crond @@ -85,7 +87,7 @@ ENV SYSTEM_SERVICES_RUN_TMP=${SYSTEM_SERVICES_RUN}/tmp ENV SYSTEM_SERVICES_RUN_LOG=${SYSTEM_SERVICES_RUN}/logs ENV PHP_FPM_CONFIG_FILE=${SYSTEM_SERVICES_PHP_FOLDER}/php-fpm.conf ENV READ_ONLY_FOLDERS="${NETALERTX_BACK} ${NETALERTX_FRONT} ${NETALERTX_SERVER} ${SYSTEM_SERVICES} \ - ${SYSTEM_SERVICES_CONFIG}" + ${SYSTEM_SERVICES_CONFIG} ${ENTRYPOINT_CHECKS}" ENV READ_WRITE_FOLDERS="${NETALERTX_CONFIG} ${NETALERTX_DB} ${NETALERTX_API} ${NETALERTX_LOG} \ ${NETALERTX_PLUGINS_LOG} ${SYSTEM_SERVICES_RUN} ${SYSTEM_SERVICES_RUN_TMP} \ ${SYSTEM_SERVICES_RUN_LOG}" @@ -184,7 +186,7 @@ RUN chown -R ${READ_ONLY_USER}:${READ_ONLY_GROUP} ${READ_ONLY_FOLDERS} && \ chmod -R 600 ${READ_WRITE_FOLDERS} && \ find ${READ_WRITE_FOLDERS} -type d -exec chmod 700 {} + && \ chown ${READ_ONLY_USER}:${READ_ONLY_GROUP} /entrypoint.sh /opt /opt/venv && \ - chmod 005 /entrypoint.sh ${SYSTEM_SERVICES}/*.sh /app /opt /opt/venv && \ + chmod 005 /entrypoint.sh ${SYSTEM_SERVICES}/*.sh ${ENTRYPOINT_CHECKS}/* /app /opt /opt/venv && \ for dir in ${READ_WRITE_FOLDERS}; do \ install -d -o ${NETALERTX_USER} -g ${NETALERTX_GROUP} -m 700 "$dir"; \ done && \ diff --git a/install/production-filesystem/entrypoint.d/0-storage-permission.sh b/install/production-filesystem/entrypoint.d/0-storage-permission.sh old mode 100644 new mode 100755 diff --git a/install/production-filesystem/entrypoint.d/10-mounts.py b/install/production-filesystem/entrypoint.d/10-mounts.py index 1df680e3..7e9f2ccd 100755 --- a/install/production-filesystem/entrypoint.d/10-mounts.py +++ b/install/production-filesystem/entrypoint.d/10-mounts.py @@ -4,6 +4,9 @@ import os import sys from dataclasses import dataclass +# if NETALERTX_DEBUG is 1 then exit +if os.environ.get("NETALERTX_DEBUG") == "1": + sys.exit(0) @dataclass class MountCheckResult: """Object to track mount status and potential issues.""" diff --git a/install/production-filesystem/entrypoint.d/30-writable-config.sh b/install/production-filesystem/entrypoint.d/30-writable-config.sh old mode 100644 new mode 100755 diff --git a/install/production-filesystem/entrypoint.d/90-excessive-capabilities.sh b/install/production-filesystem/entrypoint.d/90-excessive-capabilities.sh new file mode 100755 index 00000000..df8e8c39 --- /dev/null +++ b/install/production-filesystem/entrypoint.d/90-excessive-capabilities.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# excessive-capabilities.sh checks that no more than the necessary +# NET_ADMIN NET_BIND_SERVICE and NET_RAW capabilities are present. + +# Get bounding capabilities from /proc/self/status (what can be acquired) +BND_HEX=$(grep '^CapBnd:' /proc/self/status | awk '{print $2}' | tr -d '\t') + +# Convert hex to decimal +BND_DEC=$(( 16#$BND_HEX )) + +# Allowed capabilities: NET_BIND_SERVICE (10), NET_ADMIN (12), NET_RAW (13) +ALLOWED_DEC=$(( ( 1 << 10 ) | ( 1 << 12 ) | ( 1 << 13 ) )) + +# Check for excessive capabilities (any bits set outside allowed) +EXTRA=$(( BND_DEC & ~ALLOWED_DEC )) + +if [ "$EXTRA" -ne 0 ]; then + cat <