From 9d4190af303a46892173c2550af46aea2f334039 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 1 Jul 2020 16:59:47 +0200 Subject: [PATCH] Allow the Docker image to be run with a random user id (#12905) (#18873) Prepare docker images to be run with arbitrary user ids. Following common practices and recommendations, files that need to be read by Beats have now read permissions for the group and belong to the root group. Also, the user included in the docker image is added to the root group so it can read these files when run on docker with default user and privileges. Some changes are also added to Kubernetes reference manifests to help running beats with arbitrary user ids, though this is not completely supported and it requires additional setup. Co-authored-by: Michael Morello (cherry picked from commit 3ff02cbba4184957cf63cad3e3bf5e23d17bd0f2) --- CHANGELOG.next.asciidoc | 1 + deploy/kubernetes/auditbeat-kubernetes.yaml | 5 +++-- deploy/kubernetes/auditbeat/auditbeat-daemonset.yaml | 5 +++-- deploy/kubernetes/filebeat-kubernetes.yaml | 3 ++- deploy/kubernetes/filebeat/filebeat-daemonset.yaml | 3 ++- deploy/kubernetes/metricbeat-kubernetes.yaml | 9 +++++---- deploy/kubernetes/metricbeat/metricbeat-daemonset.yaml | 5 +++-- deploy/kubernetes/metricbeat/metricbeat-deployment.yaml | 4 ++-- dev-tools/packaging/templates/docker/Dockerfile.tmpl | 4 ++-- 9 files changed, 23 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6f2a38ba89ff..d60bd74209e8 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -372,6 +372,7 @@ field. You can revert this change by configuring tags for the module and omittin - Add support for fixed length extraction in `dissect` processor. {pull}17191[17191] - Update RPM packages contained in Beat Docker images. {issue}17035[17035] - Add TLS support to Kerberos authentication in Elasticsearch. {pull}18607[18607] +- Change ownership of files in docker images so they can be used in secured environments. {pull}12905[12905] - Upgrade k8s.io/client-go and k8s keystore tests. {pull}18817[18817] - Add support for multiple sets of hints on autodiscover {pull}18883[18883] diff --git a/deploy/kubernetes/auditbeat-kubernetes.yaml b/deploy/kubernetes/auditbeat-kubernetes.yaml index 8f9902a7c5fc..2c72ffad202a 100644 --- a/deploy/kubernetes/auditbeat-kubernetes.yaml +++ b/deploy/kubernetes/auditbeat-kubernetes.yaml @@ -196,14 +196,15 @@ spec: path: /etc - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: auditbeat-config - name: modules configMap: - defaultMode: 0600 + defaultMode: 0640 name: auditbeat-daemonset-modules - name: data hostPath: + # When auditbeat runs as non-root user, this directory needs to be writable by group (g+w). path: /var/lib/auditbeat-data type: DirectoryOrCreate - name: run-containerd diff --git a/deploy/kubernetes/auditbeat/auditbeat-daemonset.yaml b/deploy/kubernetes/auditbeat/auditbeat-daemonset.yaml index 21ffb167107a..39eaf726eefc 100644 --- a/deploy/kubernetes/auditbeat/auditbeat-daemonset.yaml +++ b/deploy/kubernetes/auditbeat/auditbeat-daemonset.yaml @@ -109,14 +109,15 @@ spec: path: /etc - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: auditbeat-config - name: modules configMap: - defaultMode: 0600 + defaultMode: 0640 name: auditbeat-daemonset-modules - name: data hostPath: + # When auditbeat runs as non-root user, this directory needs to be writable by group (g+w). path: /var/lib/auditbeat-data type: DirectoryOrCreate - name: run-containerd diff --git a/deploy/kubernetes/filebeat-kubernetes.yaml b/deploy/kubernetes/filebeat-kubernetes.yaml index e9bef35252c8..1fc3d7d996d5 100644 --- a/deploy/kubernetes/filebeat-kubernetes.yaml +++ b/deploy/kubernetes/filebeat-kubernetes.yaml @@ -112,7 +112,7 @@ spec: volumes: - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: filebeat-config - name: varlibdockercontainers hostPath: @@ -123,6 +123,7 @@ spec: # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart - name: data hostPath: + # When filebeat runs as non-root user, this directory needs to be writable by group (g+w). path: /var/lib/filebeat-data type: DirectoryOrCreate --- diff --git a/deploy/kubernetes/filebeat/filebeat-daemonset.yaml b/deploy/kubernetes/filebeat/filebeat-daemonset.yaml index 20c742d518d9..b6df8f31fdbd 100644 --- a/deploy/kubernetes/filebeat/filebeat-daemonset.yaml +++ b/deploy/kubernetes/filebeat/filebeat-daemonset.yaml @@ -68,7 +68,7 @@ spec: volumes: - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: filebeat-config - name: varlibdockercontainers hostPath: @@ -79,5 +79,6 @@ spec: # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart - name: data hostPath: + # When filebeat runs as non-root user, this directory needs to be writable by group (g+w). path: /var/lib/filebeat-data type: DirectoryOrCreate diff --git a/deploy/kubernetes/metricbeat-kubernetes.yaml b/deploy/kubernetes/metricbeat-kubernetes.yaml index 7ecd50b90bae..8f37467def4e 100644 --- a/deploy/kubernetes/metricbeat-kubernetes.yaml +++ b/deploy/kubernetes/metricbeat-kubernetes.yaml @@ -177,14 +177,15 @@ spec: path: /var/run/docker.sock - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-daemonset-config - name: modules configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-daemonset-modules - name: data hostPath: + # When metricbeat runs as non-root user, this directory needs to be writable by group (g+w) path: /var/lib/metricbeat-data type: DirectoryOrCreate --- @@ -302,11 +303,11 @@ spec: volumes: - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-deployment-config - name: modules configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-deployment-modules --- apiVersion: rbac.authorization.k8s.io/v1 diff --git a/deploy/kubernetes/metricbeat/metricbeat-daemonset.yaml b/deploy/kubernetes/metricbeat/metricbeat-daemonset.yaml index 96f841c45198..0197fe136b6d 100644 --- a/deploy/kubernetes/metricbeat/metricbeat-daemonset.yaml +++ b/deploy/kubernetes/metricbeat/metricbeat-daemonset.yaml @@ -84,13 +84,14 @@ spec: path: /var/run/docker.sock - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-daemonset-config - name: modules configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-daemonset-modules - name: data hostPath: + # When metricbeat runs as non-root user, this directory needs to be writable by group (g+w) path: /var/lib/metricbeat-data type: DirectoryOrCreate diff --git a/deploy/kubernetes/metricbeat/metricbeat-deployment.yaml b/deploy/kubernetes/metricbeat/metricbeat-deployment.yaml index 8b0c5351ed07..0e11187cac38 100644 --- a/deploy/kubernetes/metricbeat/metricbeat-deployment.yaml +++ b/deploy/kubernetes/metricbeat/metricbeat-deployment.yaml @@ -61,9 +61,9 @@ spec: volumes: - name: config configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-deployment-config - name: modules configMap: - defaultMode: 0600 + defaultMode: 0640 name: metricbeat-deployment-modules diff --git a/dev-tools/packaging/templates/docker/Dockerfile.tmpl b/dev-tools/packaging/templates/docker/Dockerfile.tmpl index 1123bb14f7be..9080b7c534d2 100644 --- a/dev-tools/packaging/templates/docker/Dockerfile.tmpl +++ b/dev-tools/packaging/templates/docker/Dockerfile.tmpl @@ -30,7 +30,7 @@ RUN chmod 755 /usr/local/bin/docker-entrypoint RUN groupadd --gid 1000 {{ .BeatName }} RUN mkdir {{ $beatHome }}/data {{ $beatHome }}/logs && \ - chown -R root:{{ .BeatName }} {{ $beatHome }} && \ + chown -R root:root {{ $beatHome }} && \ find {{ $beatHome }} -type d -exec chmod 0750 {} \; && \ find {{ $beatHome }} -type f -exec chmod 0640 {} \; && \ chmod 0750 {{ $beatBinary }} && \ @@ -43,7 +43,7 @@ RUN mkdir {{ $beatHome }}/data {{ $beatHome }}/logs && \ chmod 0770 {{ $beatHome }}/data {{ $beatHome }}/logs {{- if ne .user "root" }} -RUN useradd -M --uid 1000 --gid 1000 --home {{ $beatHome }} {{ .user }} +RUN useradd -M --uid 1000 --gid 1000 --groups 0 --home {{ $beatHome }} {{ .user }} {{- end }} USER {{ .user }}