From 02a44ac5ccbf5a261029de552fda9648b3dcd72c Mon Sep 17 00:00:00 2001 From: TheSpad Date: Mon, 5 Sep 2022 17:50:07 +0100 Subject: [PATCH 01/11] Rework legacy custom file handling --- root/docker-mods | 121 +++++++++++------- .../s6-overlay/s6-rc.d/init-custom-files/run | 23 ++-- .../s6-overlay/s6-rc.d/init-script-check/run | 28 ++-- 3 files changed, 99 insertions(+), 73 deletions(-) diff --git a/root/docker-mods b/root/docker-mods index 64d7082..97949a6 100755 --- a/root/docker-mods +++ b/root/docker-mods @@ -10,11 +10,25 @@ set_legacy_executable_bits() { } tamper_check() { - SCRIPTS_DIR_OLD="/config/custom-cont-init.d" - SCRIPTS_DIR="/custom-cont-init.d" - SERVICES_DIR_OLD="/config/custom-services.d" - SERVICES_DIR="/custom-services.d" + #Tamper check custom service locations + if [[ -d "${SERVICES_DIR}" ]] && [[ -n "$(find ${SERVICES_DIR}/* ! -user root)" ]]; then + echo "[custom-init] **** Some of the contents of the folder '${SERVICES_DIR}' are not owned by root, which is a security risk. ****" + echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" + elif [[ -d "${SERVICES_DIR}" ]] && [[ -n "$(find ${SERVICES_DIR}/* -perm -o+w)" ]]; then + echo "[custom-init] **** Some of the contents of the folder '${SERVICES_DIR}' have write permissions for others, which is a security risk. ****" + echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" + fi + #Tamper check custom script locations + if [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR}/* ! -user root)" ]]; then + echo "[custom-init] **** Some of the contents of the folder '${SCRIPTS_DIR}' are not owned by root, which is a security risk. ****" + echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" + elif [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR}/* -perm -o+w)" ]]; then + echo "[custom-init] **** Some of the contents of the folder '${SCRIPTS_DIR}' have write permissions for others, which is a security risk. ****" + echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" + fi +} +tamper_check_legacy() { # Tamper check custom script locations if [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} ! -user root)" ]]; then echo "**** Potential tampering with custom scripts detected ****" @@ -23,54 +37,30 @@ tamper_check() { echo ) mv "${SCRIPTS_DIR_OLD}" "${SCRIPTS_DIR_OLD}.${randstr}" - echo "**** Folder ${SCRIPTS_DIR_OLD} is moved to ${SCRIPTS_DIR_OLD}.${randstr} ****" - echo "**** The folder '${SCRIPTS_DIR_OLD}' and its contents need to all be owned by root to prevent root escalation inside the container!!! ****" - mkdir -p ${SCRIPTS_DIR_OLD} - chown 0:0 ${SCRIPTS_DIR_OLD} + echo "[custom-init] **** Folder ${SCRIPTS_DIR_OLD} is moved to ${SCRIPTS_DIR_OLD}.${randstr} ****" + echo "[custom-init] **** The folder '${SCRIPTS_DIR_OLD}' and its contents need to all be owned by root to prevent root escalation inside the container!!! ****" elif [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} -perm -o+w)" ]]; then - echo "**** The folder '${SCRIPTS_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****" - echo "**** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" - fi - - if [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR} ! -user root)" ]]; then - echo "**** The folder '${SCRIPTS_DIR}' or some of its contents are not owned by root, which is a security risk. ****" - echo "**** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" - elif [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR} -perm -o+w)" ]]; then - echo "**** The folder '${SCRIPTS_DIR}' or some of its contents have write permissions for others, which is a security risk. ****" - echo "**** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" + echo "[custom-init] **** The folder '${SCRIPTS_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****" + echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" fi # Tamper check custom service locations if [[ -d "${SERVICES_DIR_OLD}" ]] && [[ -n "$(find ${SERVICES_DIR_OLD} ! -user root)" ]]; then - echo "**** Potential tampering with custom scripts detected ****" + echo "[custom-init] **** Potential tampering with custom scripts detected ****" randstr=$( tr /dev/null)" ]]; then @@ -78,15 +68,9 @@ process_custom_services() { rm -rf /etc/s6-overlay/s6-rc.d/custom-svc-* fi - if [[ -z "$(/bin/ls -A ${SERVICES_DIR} 2>/dev/null)" ]] && - [[ -z "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then - echo "[custom-init] no custom services found, skipping..." - return - fi - # Make sure custom service directory exists and has files in it if [[ -e "${SERVICES_DIR}" ]] && [[ -n "$(/bin/ls -A ${SERVICES_DIR} 2>/dev/null)" ]]; then - echo "[custom-init] service files found in ${SERVICES_DIR}" + echo "[custom-init] Service files found in ${SERVICES_DIR}" for SERVICE in "${SERVICES_DIR}"/*; do NAME="$(basename "${SERVICE}")" if [[ -f "${SERVICE}" ]]; then @@ -102,10 +86,29 @@ process_custom_services() { echo "[custom-init] ${NAME}: is not a file" fi done + else + echo "[custom-init] No custom services found, skipping..." fi + # Remove legacy folder if it's empty + if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then + echo "[custom-init] Legacy service folder ${SERVICES_DIR_OLD} is empty, deleting..." + rm -rf "${SERVICES_DIR_OLD}" + fi +} + +process_custom_services_legacy() { + + # Remove all existing custom services before continuing to ensure + # we aren't running anything the user may have removed + if [[ -n "$(/bin/ls -A /etc/s6-overlay/s6-rc.d/custom-svc-* 2>/dev/null)" ]]; then + echo "[custom-init] removing existing custom services..." + rm -rf /etc/s6-overlay/s6-rc.d/custom-svc-* + fi + + # Make sure custom service directory exists and has files in it if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then - echo "[custom-init] service files found in ${SERVICES_DIR_OLD}" + echo "[custom-init] Service files found in ${SERVICES_DIR_OLD}" for SERVICE in "${SERVICES_DIR_OLD}"/*; do NAME="$(basename "${SERVICE}")" if [[ -f "${SERVICE}" ]]; then @@ -121,6 +124,14 @@ process_custom_services() { echo "[custom-init] ${NAME}: is not a file" fi done + else + echo "[custom-init] No custom services found, skipping..." + fi + + # Remove legacy folder if it's empty + if [[ -e "${SERVICES_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SERVICES_DIR_OLD} 2>/dev/null)" ]]; then + echo "[custom-init] Legacy service folder ${SERVICES_DIR_OLD} is empty, deleting..." + rm -rf "${SERVICES_DIR_OLD}" fi } @@ -130,6 +141,7 @@ curl_check() { echo "[mod-init] Curl/JQ was not found on this system for Docker mods installing" if [[ -f /usr/bin/apt ]]; then ## Ubuntu + export DEBIAN_FRONTEND="noninteractive" apt-get update apt-get install --no-install-recommends -y \ curl \ @@ -250,11 +262,22 @@ run_mods() { done } -# Tamper check legacy services -tamper_check +# Main script loop -# Process any custom services -process_custom_services +SCRIPTS_DIR_OLD="/config/custom-cont-init.d" +SCRIPTS_DIR="/custom-cont-init.d" +SERVICES_DIR_OLD="/config/custom-services.d" +SERVICES_DIR="/custom-services.d" + +if [ ! -d "/custom-cont-init.d" ] && [ ! -d "/custom-services.d" ]; then + # Tamper check legacy custom folders + tamper_check_legacy + process_custom_services_legacy +else + # Tamper check new custom folders + tamper_check + process_custom_services +fi # Run mod logic if [[ -n "${DOCKER_MODS+x}" ]]; then diff --git a/root/etc/s6-overlay/s6-rc.d/init-custom-files/run b/root/etc/s6-overlay/s6-rc.d/init-custom-files/run index a202b5b..de28df5 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-custom-files/run +++ b/root/etc/s6-overlay/s6-rc.d/init-custom-files/run @@ -17,15 +17,9 @@ if [[ -e "${SERVICES_DIR_OLD}" ]]; then chown -R 0:0 "${SERVICES_DIR_OLD}" fi -if [[ -z "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]] && - [[ -z "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then - echo "[custom-init] no custom files found, skipping..." - exit 0 -fi - # Make sure custom init directory exists and has files in it if [[ -e "${SCRIPTS_DIR}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]]; then - echo "[custom-init] files found, executing" + echo "[custom-init] Files found, executing" for SCRIPT in "${SCRIPTS_DIR}"/*; do NAME="$(basename "${SCRIPT}")" if [[ -f "${SCRIPT}" ]]; then @@ -36,10 +30,14 @@ if [[ -e "${SCRIPTS_DIR}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" echo "[custom-init] ${NAME}: is not a file" fi done -fi -if [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then - echo "[custom-init] files found, executing" + # Remove legacy folder if it's empty + if [[ -e "${SCRIPTS_DIR}" ]] && [[ -z "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]]; then + echo "[custom-init] Legacy service folder ${SCRIPTS_DIR} is empty, deleting..." + rm -rf "${SCRIPTS_DIR}" + fi +elif [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then + echo "[custom-init] Files found, executing" for SCRIPT in "${SCRIPTS_DIR_OLD}"/*; do NAME="$(basename "${SCRIPT}")" if [[ -f "${SCRIPT}" ]]; then @@ -50,4 +48,9 @@ if [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/de echo "[custom-init] ${NAME}: is not a file" fi done +elif [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then + echo "[custom-init] Legacy files folder ${SCRIPTS_DIR_OLD} is empty, deleting..." + rm -rf "${SCRIPTS_DIR_OLD}" +else + echo "[custom-init] No custom files found, skipping..." fi diff --git a/root/etc/s6-overlay/s6-rc.d/init-script-check/run b/root/etc/s6-overlay/s6-rc.d/init-script-check/run index 74b73e7..e20e12f 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-script-check/run +++ b/root/etc/s6-overlay/s6-rc.d/init-script-check/run @@ -4,20 +4,20 @@ if [[ -n "$(/bin/ls -A "/config/custom-cont-init.d" 2>/dev/null)" ]] || [[ -n "$(/bin/ls -A "/config/custom-services.d" 2>/dev/null)" ]]; then cat << EOF | tee {/config/custom-cont-init.d/README.txt,/config/custom-services.d/README.txt} 2>/dev/null - ******************************************************** - ******************************************************** - * * - * !!!! * - * Custom scripts or services found in legacy locations * - * !!!! * - * Please move your custom scripts and services * - * to /custom-cont-init.d and /custom-services.d * - * respectively to ensure they continue working. * - * * - * Visit https://linuxserver.io/custom for more info. * - * * - ******************************************************** - ******************************************************** +******************************************************** +******************************************************** +* * +* !!!! * +* Custom scripts or services found in legacy locations * +* !!!! * +* Please move your custom scripts and services * +* to /custom-cont-init.d and /custom-services.d * +* respectively to ensure they continue working. * +* * +* Visit https://linuxserver.io/custom for more info. * +* * +******************************************************** +******************************************************** EOF fi exit 0 From f121ec8620b89dad82022a6a71ec2535c11e1a84 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Mon, 5 Sep 2022 21:55:44 +0100 Subject: [PATCH 02/11] Allow word splitting --- root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run index 1dd4fde..38ac72a 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run @@ -7,10 +7,10 @@ if [[ -f "/mod-repo-packages-to-install.list" ]]; then export DEBIAN_FRONTEND="noninteractive" apt-get update apt-get install -y --no-install-recommends \ - "$(cat /mod-repo-packages-to-install.list)" + $(cat /mod-repo-packages-to-install.list) elif [[ -f /sbin/apk ]]; then apk add --no-cache \ - "$(cat /mod-repo-packages-to-install.list)" + $(cat /mod-repo-packages-to-install.list) fi fi @@ -28,7 +28,7 @@ if [[ -f "/mod-pip-packages-to-install.list" ]]; then fi fi python3 -m pip install "${PIP_ARGS}" \ - "$(cat /mod-pip-packages-to-install.list)" + $(cat /mod-pip-packages-to-install.list) fi rm -rf \ From 9b539b59ab6b27c65dcf711aeeb21f19b3288e58 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Mon, 5 Sep 2022 22:32:17 +0100 Subject: [PATCH 03/11] Fix pip args --- root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run index 38ac72a..9b935b9 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run @@ -27,7 +27,7 @@ if [[ -f "/mod-pip-packages-to-install.list" ]]; then PIP_ARGS="-f https://wheel-index.linuxserver.io/alpine-${ALPINE_VER}/" fi fi - python3 -m pip install "${PIP_ARGS}" \ + python3 -m pip install ${PIP_ARGS} \ $(cat /mod-pip-packages-to-install.list) fi From eab3b6ba112caf96ab332ba44fb2ce86d78b478c Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Sep 2022 09:45:47 +0100 Subject: [PATCH 04/11] Fix package install logic --- .../s6-rc.d/init-mods-package-install/run | 53 +++++++++++-------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run index 9b935b9..708befa 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run @@ -2,33 +2,44 @@ # shellcheck shell=bash if [[ -f "/mod-repo-packages-to-install.list" ]]; then - echo "**** Installing all mod packages ****" - if [[ -f /usr/bin/apt ]]; then - export DEBIAN_FRONTEND="noninteractive" - apt-get update - apt-get install -y --no-install-recommends \ - $(cat /mod-repo-packages-to-install.list) - elif [[ -f /sbin/apk ]]; then - apk add --no-cache \ - $(cat /mod-repo-packages-to-install.list) + IFS=' ' read -ra REPO_PACKAGES <<< "$(cat /mod-repo-packages-to-install.list)" + if [[ ${#REPO_PACKAGES[@]} -ne 0 ]] && [[ ${REPO_PACKAGES[*]} != "" ]]; then + echo "**** Installing all mod packages ****" + if [[ -f /usr/bin/apt ]]; then + export DEBIAN_FRONTEND="noninteractive" + apt-get update + apt-get install -y --no-install-recommends \ + "${REPO_PACKAGES[@]}" + elif [[ -f /sbin/apk ]]; then + apk add --no-cache \ + "${REPO_PACKAGES[@]}" + elif [ -f /usr/bin/dnf ]; then + dnf install -y --setopt=install_weak_deps=False --best \ + "${REPO_PACKAGES[@]}" + fi fi fi if [[ -f "/mod-pip-packages-to-install.list" ]]; then - echo "**** Installing all pip packages ****" - python3 -m pip install -U pip wheel setuptools - if [[ -f /usr/bin/apt ]]; then - PIP_ARGS="-f https://wheel-index.linuxserver.io/ubuntu/" - elif [[ -f /sbin/apk ]]; then - ALPINE_VER=$(grep main /etc/apk/repositories | sed 's|.*alpine/v||' | sed 's|/main.*||') - if [[ "${ALPINE_VER}" = "3.14" ]]; then - PIP_ARGS="-f https://wheel-index.linuxserver.io/alpine/" - else - PIP_ARGS="-f https://wheel-index.linuxserver.io/alpine-${ALPINE_VER}/" + IFS=' ' read -ra PIP_PACKAGES <<< "$(cat /mod-pip-packages-to-install.list)" + if [[ ${#PIP_PACKAGES[@]} -ne 0 ]] && [[ ${PIP_PACKAGES[*]} != "" ]]; then + echo "**** Installing all pip packages ****" + python3 -m pip install -U pip wheel setuptools + PIP_ARGS=() + if [[ -f /usr/bin/apt ]]; then + PIP_ARGS+=("-f" "https://wheel-index.linuxserver.io/ubuntu/") + elif [[ -f /sbin/apk ]]; then + ALPINE_VER=$(grep main /etc/apk/repositories | sed 's|.*alpine/v||' | sed 's|/main.*||') + if [[ "${ALPINE_VER}" = "3.14" ]]; then + PIP_ARGS+=("-f" "https://wheel-index.linuxserver.io/alpine/") + else + PIP_ARGS+=("-f" "https://wheel-index.linuxserver.io/alpine-${ALPINE_VER}/") + fi fi + python3 -m pip install \ + "${PIP_ARGS[@]}" \ + "${PIP_PACKAGES[@]}" fi - python3 -m pip install ${PIP_ARGS} \ - $(cat /mod-pip-packages-to-install.list) fi rm -rf \ From ce139478caa63855125218a13ae08b16ffef9faa Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Sep 2022 10:52:16 +0100 Subject: [PATCH 05/11] Remove Fedora logic --- root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run | 3 --- 1 file changed, 3 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run index 708befa..8bfe1f0 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run @@ -13,9 +13,6 @@ if [[ -f "/mod-repo-packages-to-install.list" ]]; then elif [[ -f /sbin/apk ]]; then apk add --no-cache \ "${REPO_PACKAGES[@]}" - elif [ -f /usr/bin/dnf ]; then - dnf install -y --setopt=install_weak_deps=False --best \ - "${REPO_PACKAGES[@]}" fi fi fi From c21860dab04f93ed8cfae7c9a1adce197f46e68d Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Sep 2022 11:04:56 +0100 Subject: [PATCH 06/11] Handle multiple mods cleanly --- root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run index 8bfe1f0..81987dc 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run @@ -2,7 +2,7 @@ # shellcheck shell=bash if [[ -f "/mod-repo-packages-to-install.list" ]]; then - IFS=' ' read -ra REPO_PACKAGES <<< "$(cat /mod-repo-packages-to-install.list)" + IFS=' ' read -ra REPO_PACKAGES <<< "$(tr '\n' ' ' < /mod-repo-packages-to-install.list)" if [[ ${#REPO_PACKAGES[@]} -ne 0 ]] && [[ ${REPO_PACKAGES[*]} != "" ]]; then echo "**** Installing all mod packages ****" if [[ -f /usr/bin/apt ]]; then @@ -18,7 +18,7 @@ if [[ -f "/mod-repo-packages-to-install.list" ]]; then fi if [[ -f "/mod-pip-packages-to-install.list" ]]; then - IFS=' ' read -ra PIP_PACKAGES <<< "$(cat /mod-pip-packages-to-install.list)" + IFS=' ' read -ra PIP_PACKAGES <<< "$(tr '\n' ' ' < /mod-pip-packages-to-install.list)" if [[ ${#PIP_PACKAGES[@]} -ne 0 ]] && [[ ${PIP_PACKAGES[*]} != "" ]]; then echo "**** Installing all pip packages ****" python3 -m pip install -U pip wheel setuptools From 0a22896061fa79199a580217e73d75387d886d1a Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Sep 2022 15:45:38 +0100 Subject: [PATCH 07/11] Standardise output --- root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run index 81987dc..90b4b2e 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run +++ b/root/etc/s6-overlay/s6-rc.d/init-mods-package-install/run @@ -4,7 +4,7 @@ if [[ -f "/mod-repo-packages-to-install.list" ]]; then IFS=' ' read -ra REPO_PACKAGES <<< "$(tr '\n' ' ' < /mod-repo-packages-to-install.list)" if [[ ${#REPO_PACKAGES[@]} -ne 0 ]] && [[ ${REPO_PACKAGES[*]} != "" ]]; then - echo "**** Installing all mod packages ****" + echo "[mod-init] **** Installing all mod packages ****" if [[ -f /usr/bin/apt ]]; then export DEBIAN_FRONTEND="noninteractive" apt-get update @@ -20,7 +20,7 @@ fi if [[ -f "/mod-pip-packages-to-install.list" ]]; then IFS=' ' read -ra PIP_PACKAGES <<< "$(tr '\n' ' ' < /mod-pip-packages-to-install.list)" if [[ ${#PIP_PACKAGES[@]} -ne 0 ]] && [[ ${PIP_PACKAGES[*]} != "" ]]; then - echo "**** Installing all pip packages ****" + echo "[mod-init] **** Installing all pip packages ****" python3 -m pip install -U pip wheel setuptools PIP_ARGS=() if [[ -f /usr/bin/apt ]]; then From e109ae692e276e4005375bcf4404880c4a89abbf Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 6 Sep 2022 15:46:58 +0100 Subject: [PATCH 08/11] Fix missing output prefix --- root/docker-mods | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root/docker-mods b/root/docker-mods index 97949a6..ae649de 100755 --- a/root/docker-mods +++ b/root/docker-mods @@ -31,7 +31,7 @@ tamper_check() { tamper_check_legacy() { # Tamper check custom script locations if [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} ! -user root)" ]]; then - echo "**** Potential tampering with custom scripts detected ****" + echo "[custom-init] **** Potential tampering with custom scripts detected ****" randstr=$( tr Date: Fri, 9 Sep 2022 16:22:45 +0100 Subject: [PATCH 09/11] Remove the *old* scripts dir, not the new one --- root/etc/s6-overlay/s6-rc.d/init-custom-files/run | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/root/etc/s6-overlay/s6-rc.d/init-custom-files/run b/root/etc/s6-overlay/s6-rc.d/init-custom-files/run index de28df5..86ca303 100755 --- a/root/etc/s6-overlay/s6-rc.d/init-custom-files/run +++ b/root/etc/s6-overlay/s6-rc.d/init-custom-files/run @@ -32,9 +32,9 @@ if [[ -e "${SCRIPTS_DIR}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" done # Remove legacy folder if it's empty - if [[ -e "${SCRIPTS_DIR}" ]] && [[ -z "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]]; then - echo "[custom-init] Legacy service folder ${SCRIPTS_DIR} is empty, deleting..." - rm -rf "${SCRIPTS_DIR}" + if [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -z "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then + echo "[custom-init] Legacy files folder ${SCRIPTS_DIR_OLD} is empty, deleting..." + rm -rf "${SCRIPTS_DIR_OLD}" fi elif [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then echo "[custom-init] Files found, executing" From 019aa0a3d161665be8b45cd625d3122d1fc63a1e Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 9 Sep 2022 16:39:24 +0100 Subject: [PATCH 10/11] Move var declaration to top of file for clarity. --- root/docker-mods | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/root/docker-mods b/root/docker-mods index ae649de..4ab4cd5 100755 --- a/root/docker-mods +++ b/root/docker-mods @@ -1,6 +1,12 @@ #!/usr/bin/with-contenv bash # shellcheck shell=bash +# Define custom folder paths +SCRIPTS_DIR_OLD="/config/custom-cont-init.d" +SCRIPTS_DIR="/custom-cont-init.d" +SERVICES_DIR_OLD="/config/custom-services.d" +SERVICES_DIR="/custom-services.d" + # Set executable bit on cont-init and services built into the image set_legacy_executable_bits() { mkdir -p /etc/{cont-init.d,services.d} @@ -264,11 +270,6 @@ run_mods() { # Main script loop -SCRIPTS_DIR_OLD="/config/custom-cont-init.d" -SCRIPTS_DIR="/custom-cont-init.d" -SERVICES_DIR_OLD="/config/custom-services.d" -SERVICES_DIR="/custom-services.d" - if [ ! -d "/custom-cont-init.d" ] && [ ! -d "/custom-services.d" ]; then # Tamper check legacy custom folders tamper_check_legacy From b21fa71c22975ebb30650d34a4b2d9fd5ddf6e57 Mon Sep 17 00:00:00 2001 From: TheSpad Date: Fri, 9 Sep 2022 19:45:10 +0100 Subject: [PATCH 11/11] Use DIR vars for folder check --- root/docker-mods | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/root/docker-mods b/root/docker-mods index 4ab4cd5..5cb356a 100755 --- a/root/docker-mods +++ b/root/docker-mods @@ -270,7 +270,7 @@ run_mods() { # Main script loop -if [ ! -d "/custom-cont-init.d" ] && [ ! -d "/custom-services.d" ]; then +if [ ! -d "${SCRIPTS_DIR}" ] && [ ! -d "${SERVICES_DIR}" ]; then # Tamper check legacy custom folders tamper_check_legacy process_custom_services_legacy