|
| 1 | +#!/bin/sh |
| 2 | + |
| 3 | +# 0-storage-permission.sh: Fix permissions if running as root. |
| 4 | +# |
| 5 | +# This script checks if running as root and fixes ownership and permissions |
| 6 | +# for read-write paths to ensure proper operation. |
| 7 | + |
| 8 | +# --- Color Codes --- |
| 9 | +MAGENTA=$(printf '\033[1;35m') |
| 10 | +RESET=$(printf '\033[0m') |
| 11 | + |
| 12 | +# --- Main Logic --- |
| 13 | + |
| 14 | +# Define paths that need read-write access |
| 15 | +READ_WRITE_PATHS=" |
| 16 | +${NETALERTX_DATA} |
| 17 | +${NETALERTX_DB} |
| 18 | +${NETALERTX_API} |
| 19 | +${NETALERTX_LOG} |
| 20 | +${SYSTEM_SERVICES_RUN} |
| 21 | +${NETALERTX_CONFIG} |
| 22 | +${NETALERTX_CONFIG_FILE} |
| 23 | +${NETALERTX_DB_FILE} |
| 24 | +" |
| 25 | + |
| 26 | +TARGET_USER="${NETALERTX_USER:-netalertx}" |
| 27 | + |
| 28 | +# If running as root, fix permissions first |
| 29 | +if [ "$(id -u)" -eq 0 ]; then |
| 30 | + >&2 printf "%s" "${MAGENTA}" |
| 31 | + >&2 cat <<'EOF' |
| 32 | +══════════════════════════════════════════════════════════════════════════════ |
| 33 | +🚨 CRITICAL SECURITY ALERT: NetAlertX is running as ROOT (UID 0)! 🚨 |
| 34 | +
|
| 35 | + This configuration bypasses all built-in security hardening measures. |
| 36 | + You've granted a network monitoring application unrestricted access to |
| 37 | + your host system. A successful compromise here could jeopardize your |
| 38 | + entire infrastructure. |
| 39 | +
|
| 40 | + IMMEDIATE ACTION REQUIRED: Switch to the dedicated 'netalertx' user: |
| 41 | + * Remove any 'user:' directive specifying UID 0 from docker-compose.yml or |
| 42 | + * switch to the default USER in the image (20211:20211) |
| 43 | +
|
| 44 | + IMPORTANT: This corrective mode automatically adjusts ownership of |
| 45 | + /data/db and /data/config directories to the netalertx user, ensuring |
| 46 | + proper operation in subsequent runs. |
| 47 | +
|
| 48 | + Remember: Never operate security-critical tools as root unless you're |
| 49 | + actively trying to get pwned. |
| 50 | +
|
| 51 | + https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/running-as-root.md |
| 52 | +══════════════════════════════════════════════════════════════════════════════ |
| 53 | +EOF |
| 54 | + >&2 printf "%s" "${RESET}" |
| 55 | + |
| 56 | + # Set ownership and permissions for each read-write path individually |
| 57 | + printf '%s\n' "${READ_WRITE_PATHS}" | while IFS= read -r path; do |
| 58 | + [ -n "${path}" ] || continue |
| 59 | + echo "DEBUG: Processing $path" |
| 60 | + chown -v -R "${TARGET_USER}" "${path}" || echo "DEBUG: chown failed for $path" |
| 61 | + find "${path}" -type d -exec chmod -v u+rwx {} \; |
| 62 | + find "${path}" -type f -exec chmod -v u+rw {} \; |
| 63 | + done |
| 64 | + echo Permissions fixed for read-write paths. Please restart the container as user ${TARGET_USER}. |
| 65 | + sleep infinity & wait $! |
| 66 | +fi |
0 commit comments