almet/dangerzone
1
0
Fork 0
mirror of https://github.com/freedomofpress/dangerzone.git synced 2025-04-29 18:22:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

WIP: Repro

Browse source
This commit is contained in:
Alex Pyrgiotis 2025-02-21 12:52:34 +02:00
parent 1ec3c7cbbc
commit 864275357b
No known key found for this signature in database
GPG key ID: B6C15EBA0357C9AA
1 changed files with 10 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
Dockerfile
View file

@ -165,30 +165,30 @@ RUN mkdir /home/dangerzone/.containers
# The `ln` binary, even if you specify it by its full path, cannot run # The `ln` binary, even if you specify it by its full path, cannot run
# (probably because `ld-linux.so` can't be found). For this reason, we have # (probably because `ld-linux.so` can't be found). For this reason, we have
# to create the symlinks beforehand, in a previous build stage. Then, in an # to create the symlinks beforehand, in a previous build stage. Then, in an
# empty contianer image (scratch images), we can copy these symlinks and the # empty container image (scratch images), we can copy these symlinks and the
# /usr, and stich everything together. # /usr, and stitch everything together.
############################################################################### ###############################################################################
# Create the filesystem hierarchy that will be used to symlink /usr. # Create the filesystem hierarchy that will be used to symlink /usr.
RUN mkdir -p \ RUN mkdir -p \
/new_root \ /new_root \
/new_root/etc \
/new_root/root \ /new_root/root \
/new_root/run \ /new_root/run \
/new_root/tmp \ /new_root/tmp \
/new_root/var \ /new_root/home/dangerzone/dangerzone-image/rootfs
/new_root/home/dangerzone/dangerzone-image/rootfs \
/new_root/home/dangerzone/dangerzone-image/rootfs/etc \
/new_root/home/dangerzone/dangerzone-image/rootfs/opt \
/new_root/home/dangerzone/dangerzone-image/rootfs/usr
RUN cp -r /etc /var /new_root/
RUN cp -r /etc /opt /usr /new_root/home/dangerzone/dangerzone-image/rootfs
RUN ln -s /home/dangerzone/dangerzone-image/rootfs/usr /new_root/usr RUN ln -s /home/dangerzone/dangerzone-image/rootfs/usr /new_root/usr
RUN ln -s usr/bin /new_root/bin RUN ln -s usr/bin /new_root/bin
RUN ln -s usr/lib /new_root/lib RUN ln -s usr/lib /new_root/lib
RUN ln -s usr/lib64 /new_root/lib64 RUN ln -s usr/lib64 /new_root/lib64
RUN ln -s usr/sbin /new_root/sbin RUN ln -s usr/sbin /new_root/sbin
RUN ln -s usr/bin /new_root/home/dangerzone/dangerzone-image/rootfs/bin
RUN ln -s usr/lib /new_root/home/dangerzone/dangerzone-image/rootfs/lib
RUN ln -s usr/lib64 /new_root/home/dangerzone/dangerzone-image/rootfs/lib64
# Fix permissions in /home/dangerzone, so that our entrypoint script can make # Fix permissions in /home/dangerzone, so that our entrypoint script can make
# changes in the following folders. # changes in the following folders.
@ -198,43 +198,13 @@ RUN chown dangerzone:dangerzone \
# Fix permissions in /tmp, so that it can be used by unprivileged users. # Fix permissions in /tmp, so that it can be used by unprivileged users.
RUN chmod 777 /new_root/tmp RUN chmod 777 /new_root/tmp
## Intermediate image ## Final image
FROM scratch AS intermediate
# Copy the filesystem hierarchy that we created in the previous stage, so that
# /usr can be a symlink.
COPY --from=dangerzone-image /new_root/ /
# Copy the bare minimum to run Dangerzone in the inner container image.
COPY --from=dangerzone-image /etc/ /home/dangerzone/dangerzone-image/rootfs/etc/
COPY --from=dangerzone-image /opt/ /home/dangerzone/dangerzone-image/rootfs/opt/
COPY --from=dangerzone-image /usr/ /home/dangerzone/dangerzone-image/rootfs/usr/
RUN ln -s usr/bin /home/dangerzone/dangerzone-image/rootfs/bin
RUN ln -s usr/lib /home/dangerzone/dangerzone-image/rootfs/lib
RUN ln -s usr/lib64 /home/dangerzone/dangerzone-image/rootfs/lib64
# Copy the bare minimum to let the security scanner find vulnerabilities.
COPY --from=dangerzone-image /etc/ /etc/
COPY --from=dangerzone-image /var/ /var/
RUN chmod g-s \
/etc/ \
/home/ \
/var/ \
/root/ \
/run/ \
/home/dangerzone/dangerzone-image/rootfs/etc/ \
/home/dangerzone/dangerzone-image/rootfs/opt/ \
/home/dangerzone/dangerzone-image/rootfs/usr/
### Final image
FROM scratch FROM scratch
# Copy the filesystem hierarchy that we created in the previous stage, so that # Copy the filesystem hierarchy that we created in the previous stage, so that
# /usr can be a symlink. # /usr can be a symlink.
COPY --from=intermediate / / COPY --from=dangerzone-image /new_root/ /
# Switch to the dangerzone user for the rest of the script. # Switch to the dangerzone user for the rest of the script.
USER dangerzone USER dangerzone