79 lines
3.4 KiB
Plaintext
Executable file
79 lines
3.4 KiB
Plaintext
Executable file
#!/usr/bin/with-contenv bash
|
|
# shellcheck shell=bash
|
|
|
|
# Directories
|
|
SCRIPTS_DIR_OLD="/config/custom-cont-init.d"
|
|
SCRIPTS_DIR="/custom-cont-init.d"
|
|
|
|
SERVICES_DIR_OLD="/config/custom-services.d"
|
|
|
|
# Tamper check custom script locations
|
|
if [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} ! -user root)" ]]; then
|
|
echo "**** Potential tampering with custom scripts detected ****"
|
|
randstr=$(
|
|
tr </dev/urandom -dc _A-Z-a-z-0-9 | head -c8
|
|
echo
|
|
)
|
|
mv "${SCRIPTS_DIR_OLD}" "${SCRIPTS_DIR_OLD}.${randstr}"
|
|
echo "**** Folder ${SCRIPTS_DIR_OLD} is moved to ${SCRIPTS_DIR_OLD}.${randstr} ****"
|
|
echo "**** The folder '${SCRIPTS_DIR_OLD}' and its contents need to all be owned by root to prevent root escalation inside the container!!! ****"
|
|
mkdir -p ${SCRIPTS_DIR_OLD}
|
|
chown 0:0 ${SCRIPTS_DIR_OLD}
|
|
elif [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} -perm -o+w)" ]]; then
|
|
echo "**** The folder '${SCRIPTS_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****"
|
|
echo "**** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****"
|
|
fi
|
|
|
|
if [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR} ! -user root)" ]]; then
|
|
echo "**** The folder '${SCRIPTS_DIR}' or some of its contents are not owned by root, which is a security risk. ****"
|
|
echo "**** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****"
|
|
elif [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR} -perm -o+w)" ]]; then
|
|
echo "**** The folder '${SCRIPTS_DIR}' or some of its contents have write permissions for others, which is a security risk. ****"
|
|
echo "**** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****"
|
|
fi
|
|
|
|
# chown legacy folders if they exist
|
|
if [[ -e "${SCRIPTS_DIR_OLD}" ]]; then
|
|
chown -R 0:0 "${SCRIPTS_DIR_OLD}"
|
|
fi
|
|
|
|
# chown legacy folders if they exist
|
|
if [[ -e "${SERVICES_DIR_OLD}" ]]; then
|
|
chown -R 0:0 "${SERVICES_DIR_OLD}"
|
|
fi
|
|
|
|
if [[ -z "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]] &&
|
|
[[ -z "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then
|
|
echo "[custom-init] no custom files found, skipping..."
|
|
exit 0
|
|
fi
|
|
|
|
# Make sure custom init directory exists and has files in it
|
|
if [[ -e "${SCRIPTS_DIR}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR} 2>/dev/null)" ]]; then
|
|
echo "[custom-init] files found, executing"
|
|
for SCRIPT in "${SCRIPTS_DIR}"/*; do
|
|
NAME="$(basename "${SCRIPT}")"
|
|
if [[ -f "${SCRIPT}" ]]; then
|
|
echo "[custom-init] ${NAME}: executing..."
|
|
/bin/bash "${SCRIPT}"
|
|
echo "[custom-init] ${NAME}: exited $?"
|
|
elif [[ ! -f "${SCRIPT}" ]]; then
|
|
echo "[custom-init] ${NAME}: is not a file"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [[ -e "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(/bin/ls -A ${SCRIPTS_DIR_OLD} 2>/dev/null)" ]]; then
|
|
echo "[custom-init] files found, executing"
|
|
for SCRIPT in "${SCRIPTS_DIR_OLD}"/*; do
|
|
NAME="$(basename "${SCRIPT}")"
|
|
if [[ -f "${SCRIPT}" ]]; then
|
|
echo "[custom-init] ${NAME}: executing..."
|
|
/bin/bash "${SCRIPT}"
|
|
echo "[custom-init] ${NAME}: exited $?"
|
|
elif [[ ! -f "${SCRIPT}" ]]; then
|
|
echo "[custom-init] ${NAME}: is not a file"
|
|
fi
|
|
done
|
|
fi
|