commit e9241770840e672e838a1aa1d1c38cebabe62d0a Author: Colin Walters walters@verbum.org Date: Tue Dec 16 16:26:01 2014 -0500
docker: Don't use a hardcoded root password
Best practice is to use unprivileged service daemons inside Docker containers. But with this hardcoded root password, in the case of remote code execution, an attacker could trivially escalate their privileges to root/uid 0. And while that's uid 0 inside a container, that's a much larger attack surface.
Instead, do the same thing we're doing for the Cloud images: lock the root password, create a user to make Anaconda happy, then delete the user in %post.
https://bugzilla.redhat.com/show_bug.cgi?id=1175997
Conflicts: fedora-docker-base.ks
fedora-docker-base.ks | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) --- diff --git a/fedora-docker-base.ks b/fedora-docker-base.ks index 78e5b93..eda9b21 100644 --- a/fedora-docker-base.ks +++ b/fedora-docker-base.ks @@ -6,7 +6,8 @@ cmdline bootloader --location=none timezone America/New_York --isUtc --nontp -rootpw --plaintext qweqwe +rootpw --lock --iscrypted locked +user --name=none
keyboard us firewall --disable @@ -31,6 +32,9 @@ yum # Set the language rpm nodocs transaction flag persistently in the # image yum.conf and rpm macros
+# remove the user anaconda forces us to make +userdel -r none + LANG="en_US" echo "%_install_lang $LANG" > /etc/rpm/macros.image-language-conf