diff --git a/.gitignore b/.gitignore index 8289cba..e1495fa 100644 --- a/.gitignore +++ b/.gitignore @@ -1,18 +1,5 @@ -# Ignore default config file for testing -glauth.cfg - -# Ignore the built binary during testing -glauth - -# Ignore generated certs in this folder -certs/ - -# Built binaries -bin - .*.swp - -certs/ - -# Local files -local/ +v2/certs/ +v2/bin +v2/docker/assets/linux +v2/gl.db diff --git a/README.md b/README.md index 746f403..8ac13b2 100644 --- a/README.md +++ b/README.md @@ -7,8 +7,6 @@ Go-lang LDAP Authentication (GLAuth) is a secure, easy-to-use, LDAP server w/ co ![GitHub all releases](https://img.shields.io/github/downloads/glauth/glauth/total) ![Docker pulls](https://badgen.net/docker/pulls/glauth/glauth) -![Docker Automated build](https://img.shields.io/docker/automated/glauth/glauth) - ![GitHub last commit (branch)](https://img.shields.io/github/last-commit/glauth/glauth/dev) ![Code Climate maintainability](https://img.shields.io/codeclimate/maintainability-percentage/glauth/glauth) @@ -21,6 +19,14 @@ Go-lang LDAP Authentication (GLAuth) is a secure, easy-to-use, LDAP server w/ co Use it to centralize account management across your Linux servers, your OSX machines, and your support applications (Jenkins, Apache/Nginx, Graylog2, and many more!). +
+ +### Documentation + +

:point_right: The latest version of GLauth's documentation is available at https://glauth.github.io/ :point_left:

+ +
+ ### Contributing - Please base all Pull Requests on [dev](https://github.com/glauth/glauth/tree/dev), not master. - Format your code autonmatically using `gofmt -d ./` before committing @@ -29,7 +35,7 @@ Use it to centralize account management across your Linux servers, your OSX mach This quickstart is a great way to try out GLAuth in a non-production environment. *Be warned that you should take the extra steps to setup SSL (TLS) for production use!* 1. Download a precompiled binary from the [releases](https://github.com/glauth/glauth/releases) page. -2. Download the [example config file](https://github.com/glauth/glauth/blob/master/sample-simple.cfg). +2. Download the [example config file](https://raw.githubusercontent.com/glauth/glauth/master/v2/sample-simple.cfg). 3. Start the GLAuth server, referencing the path to the desired config file with `-c`. - `./glauth64 -c sample-simple.cfg` 4. Test with traditional LDAP tools @@ -47,10 +53,18 @@ Note - makefile uses git data to inject build-time variables. For best results, *make run* - wrapper for the 'go run' command, setting up the needed tooling -*make plugins* - build additional (SQL) plugin backends +*make pull-base-plugins* - add base plugins code as submodules for local build + +*make forget-plugins* - remove all plugins from current tree *make test* - run the integration test on linux64 binary +*make releaseplugins* - build app plugins that we pulled locally + +*make releasedocker* - build main and plugins, push to docker hub + +*make testdocker* - quick docker sanity check + ### Usage: ``` glauth: securely expose your LDAP for external auth diff --git a/v2/Makefile b/v2/Makefile index 84fb8ce..6080944 100644 --- a/v2/Makefile +++ b/v2/Makefile @@ -18,8 +18,12 @@ BUILD_VARS=-s -w -X main.GitCommit=${GIT_COMMIT} -X main.GitBranch=${GIT_BRANCH} BUILD_FILES=glauth.go TRIM_FLAGS=-gcflags "all=-trimpath=${PWD}" -asmflags "all=-trimpath=${PWD}" +# Targets +MAIN_TARGETS=linux/amd64,linux/386,linux/arm64,linux/arm-7,darwin/amd64,darwin/arm64,windows/amd64,windows/386 +PLUGIN_TARGETS=linux/amd64,linux/386,linux/arm64,linux/arm-7,darwin/amd64,darwin/arm64 + # Plugins -include pkg/plugins/Makefile +include pkg/plugins/*/Makefile ##################### # High level commands @@ -91,6 +95,102 @@ winamd64: verify: @for binary in linux386 linuxamd64 linuxarm linuxarm64 darwinamd64 darwinarm64 win386 winamd64; do cd bin/$$binary && sha256sum glauth.sha256 -c && cd ../..; done -release: linux386 linuxamd64 linuxarm linuxarm64 win386 winamd64 +pull-plugin: + @git submodule add $U $M && \ + (for pkg in $$(cat $$M/go.mod | awk '/^require [a-z]/{print $$2} /^\)/{rblock=0} rblock{if($$4!="indirect" && $$1!~"glauth"){print $$1}} /^require \(/{rblock=1}'); do if [ "$$(grep $$pkg go.mod &>/dev/null)" = "" ]; then go get $$pkg; fi; done) -release_darwin: darwinamd64 darwinarm64 +pull-base-plugins: + @U=https://github.com/glauth/glauth-sqlite M=pkg/plugins/glauth-sqlite make pull-plugin && \ + U=https://github.com/glauth/glauth-mysql M=pkg/plugins/glauth-mysql make pull-plugin && \ + U=https://github.com/glauth/glauth-postgres M=pkg/plugins/glauth-postgres make pull-plugin && \ + U=https://github.com/glauth/glauth-pam M=pkg/plugins/glauth-pam make pull-plugin + +forget-plugin: + rm -rf $M ../.git/modules/v2/$M && \ + git config --remove-section submodule.v2/$M && \ + git rm --cache $M && \ + go mod tidy + +forget-plugins: + for pkg in pkg/plugins/*/go.mod; do\ + P=$$(echo $$pkg | cut -d'/' -f 3) M=$$(dirname $$pkg) make forget-plugin;\ + done + +releasemain: + @xgo -v -ldflags="${BUILD_VARS}" -trimpath -go 1.18.1 -out glauth -dest bin -buildvcs=false --targets="${MAIN_TARGETS}" . + +releaseplugin: + @xgo -v -ldflags="${BUILD_VARS}" -trimpath -go 1.18.1 -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go . && \ + (cd bin && for lib in $$(ls $$P-*); do mv $$lib $$lib.so; done) + +releaseplugins: + @for pkg in pkg/plugins/*/go.mod; do\ + P=$$(echo $$pkg | cut -d'/' -f 3) && make release-$$P;\ + done + +releasedockermain: + $(if $(TAG),,$(error Must set TAG)) + $(if $(REPO),,$(error Must set REPO - glauth or other)) + @mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \ + cp -f bin/glauth-linux-amd64 docker/assets/linux/amd64/glauth && \ + cp -f bin/glauth-linux-arm64 docker/assets/linux/arm64/glauth && \ + cp -f bin/glauth-linux-arm-7 docker/assets/linux/arm/v7/glauth && \ + docker buildx build --tag $$REPO/glauth:$$TAG -t $$REPO/glauth:latest -f docker/Dockerfile-standalone --platform linux/amd64,linux/arm64,linux/arm/v7 --push docker + +releasedockerplugins: + $(if $(TAG),,$(error Must set TAG)) + $(if $(REPO),,$(error Must set REPO - glauth or other)) + @mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \ + cp -f bin/sqlite-linux-amd64.so docker/assets/linux/amd64/sqlite.so && \ + cp -f bin/sqlite-linux-arm64.so docker/assets/linux/arm64/sqlite.so && \ + cp -f bin/sqlite-linux-arm-7.so docker/assets/linux/arm/v7/sqlite.so && \ + cp -f bin/mysql-linux-amd64.so docker/assets/linux/amd64/mysql.so && \ + cp -f bin/mysql-linux-arm64.so docker/assets/linux/arm64/mysql.so && \ + cp -f bin/mysql-linux-arm-7.so docker/assets/linux/arm/v7/mysql.so && \ + cp -f bin/postgres-linux-amd64.so docker/assets/linux/amd64/postgres.so && \ + cp -f bin/postgres-linux-arm64.so docker/assets/linux/arm64/postgres.so && \ + cp -f bin/postgres-linux-arm-7.so docker/assets/linux/arm/v7/postgres.so && \ + docker buildx build --tag $$REPO/glauth-plugins:$$TAG -t $$REPO/glauth-plugins:latest -f docker/Dockerfile-plugins --platform linux/amd64,linux/arm64,linux/arm/v7 --push docker + +releasedocker: releasedockermain releasedockerplugins + +testdocker: + $(if $(REPO),,$(error Must set REPO - glauth or other)) + @echo "==> Cleaning up any existing image to be on the safe side..." && \ + (for image in $$(docker image ls -q "$$REPO/glauth*"); do \ + for container in $$(docker container ls -a -q -f ancestor=$$image); do \ + docker stop $$container; \ + while [ "$$(docker container ls -q -f ancestor=$$image)" != "" ]; do sleep 1; done; \ + docker rm $$container; \ + done; \ + docker rmi $$image; \ + done) && \ + echo "==> Running glauth main container..." && \ + docker run -d --name glauth-test -p 3893:3893 $$REPO/glauth:latest && \ + sleep 5 && \ + if [ "$$(ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com cn=hackers | grep posixAccount)" != "" ]; then \ + echo "Checked: Glauth is responding properly to ldapsearch query."; \ + else \ + echo "glauth check did not pass. Aborting."; \ + exit 1; \ + fi && \ + echo "==> Stopping glauth main container..." && \ + docker stop glauth-test && \ + while [ "$$(docker ps -q -f name=glauth-test)" != "" ]; do sleep 1; done; \ + docker rm glauth-test && \ + echo "==> Running glauth plugins container..." && \ + docker run -d --name glauth-test -p 3893:3893 $$REPO/glauth-plugins:latest && \ + sleep 5 && \ + if [ "$$(ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com cn=hackers | grep posixAccount)" != "" ]; then \ + echo "Checked: Glauth is responding properly to ldapsearch query."; \ + else \ + echo "glauth check did not pass. Aborting."; \ + exit 1; \ + fi && \ + echo "==> Stopping glauth plugins container..." && \ + docker stop glauth-test && \ + while [ "$$(docker ps -q -f name=glauth-test)" != "" ]; do sleep 1; done; \ + docker rm glauth-test && \ + echo "==> Testing complete." + +.PHONY: all run test fast binaries setup getdeps runtest updatetest format devrun linux386 linuxamd64 linuxarm linuxarm64 darwinamd64 darwinarm64 win386 winamd64 verify pull-plugin pull-base-plugins forget-plugin forget-plugins releasemain releaseplugin release releaseplugins releasedockermain releaserdockerplugins releasedocker testdocker diff --git a/v2/docker/Dockerfile-plugins b/v2/docker/Dockerfile-plugins new file mode 100644 index 0000000..45d012c --- /dev/null +++ b/v2/docker/Dockerfile-plugins @@ -0,0 +1,35 @@ +################# +# Build Step +################# + +FROM alpine:latest as build + +RUN apk add --no-cache git make busybox-static dumb-init + +################# +# Run Step +################# + +FROM gcr.io/distroless/base-debian11 as run +LABEL maintainers="Ben Yanke , Jörn Friedrich Dreyer , Chris F Ravenscroft " +ARG TARGETPLATFORM + +# Copy docker specific scripts from build container +COPY assets/start-plugins.sh /app/docker/start-plugins.sh +COPY assets/default-config-plugins.cfg /app/docker/default-config-plugins.cfg +COPY assets/gl.db /app/docker/gl.db +COPY assets/$TARGETPLATFORM/glauth /app/glauth +COPY assets/$TARGETPLATFORM/*.so /app/ + +# Just what we need +COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init +COPY --from=build /bin/busybox.static /bin/sh +COPY --from=build /bin/busybox.static /bin/ln +COPY --from=build /bin/busybox.static /bin/rm +RUN ln /bin/sh /usr/bin/cp && ln /bin/sh /usr/bin/mkdir && rm /bin/ln /bin/rm + +# Expose web and LDAP ports +EXPOSE 389 636 5555 + +ENTRYPOINT ["/usr/bin/dumb-init", "--"] +CMD ["/bin/sh", "/app/docker/start-plugins.sh"] diff --git a/v2/docker/Dockerfile-standalone b/v2/docker/Dockerfile-standalone new file mode 100644 index 0000000..1fe2b85 --- /dev/null +++ b/v2/docker/Dockerfile-standalone @@ -0,0 +1,33 @@ +################# +# Build Step +################# + +FROM alpine:latest as build + +RUN apk add --no-cache git make busybox-static dumb-init + +################# +# Run Step +################# + +FROM gcr.io/distroless/base-debian11 as run +LABEL maintainers="Ben Yanke , Jörn Friedrich Dreyer , Chris F Ravenscroft " +ARG TARGETPLATFORM + +# Copy docker specific scripts from build container +COPY assets/start-standalone.sh /app/docker/start-standalone.sh +COPY assets/default-config-standalone.cfg /app/docker/default-config-standalone.cfg +COPY assets/$TARGETPLATFORM/glauth /app/glauth + +# Just what we need +COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init +COPY --from=build /bin/busybox.static /bin/sh +COPY --from=build /bin/busybox.static /bin/ln +COPY --from=build /bin/busybox.static /bin/rm +RUN ln /bin/sh /usr/bin/cp && ln /bin/sh /usr/bin/mkdir && rm /bin/ln /bin/rm + +# Expose web and LDAP ports +EXPOSE 389 636 5555 + +ENTRYPOINT ["/usr/bin/dumb-init", "--"] +CMD ["/bin/sh", "/app/docker/start-standalone.sh"] diff --git a/v2/scripts/docker/default-config-plugins.cfg b/v2/docker/assets/default-config-plugins.cfg similarity index 100% rename from v2/scripts/docker/default-config-plugins.cfg rename to v2/docker/assets/default-config-plugins.cfg diff --git a/v2/scripts/docker/default-config-standalone.cfg b/v2/docker/assets/default-config-standalone.cfg similarity index 100% rename from v2/scripts/docker/default-config-standalone.cfg rename to v2/docker/assets/default-config-standalone.cfg diff --git a/v2/scripts/docker/gl.db b/v2/docker/assets/gl.db similarity index 100% rename from v2/scripts/docker/gl.db rename to v2/docker/assets/gl.db diff --git a/v2/scripts/docker/start-plugins.sh b/v2/docker/assets/start-plugins.sh similarity index 100% rename from v2/scripts/docker/start-plugins.sh rename to v2/docker/assets/start-plugins.sh diff --git a/v2/scripts/docker/start-standalone.sh b/v2/docker/assets/start-standalone.sh similarity index 100% rename from v2/scripts/docker/start-standalone.sh rename to v2/docker/assets/start-standalone.sh diff --git a/v2/go.mod b/v2/go.mod index 15df14b..dccb1dd 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -13,12 +13,8 @@ require ( github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 github.com/fsnotify/fsnotify v1.4.9 github.com/go-logr/logr v0.4.0 - github.com/go-sql-driver/mysql v1.5.0 github.com/hydronica/toml v0.4.2 github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a - github.com/lib/pq v1.10.0 - github.com/mattn/go-sqlite3 v1.14.6 - github.com/msteinert/pam v1.0.0 github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 github.com/pquerna/otp v1.3.0 diff --git a/v2/go.sum b/v2/go.sum index 8d72cc8..31837e5 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -15,8 +15,6 @@ github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWo github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc= github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= -github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs= -github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8= @@ -32,12 +30,6 @@ github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfn github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= -github.com/lib/pq v1.10.0 h1:Zx5DJFEYQXio93kgXnQ09fXNiUKsqv4OUEu2UtGcB1E= -github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= -github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg= -github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU= -github.com/msteinert/pam v1.0.0 h1:4XoXKtMCH3+e6GIkW41uxm6B37eYqci/DH3gzSq7ocg= -github.com/msteinert/pam v1.0.0/go.mod h1:M4FPeAW8g2ITO68W8gACDz13NDJyOQM9IQsQhrR6TOI= github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 h1:D9EvfGQvlkKaDr2CRKN++7HbSXbefUNDrPq60T+g24s= github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484/go.mod h1:O1EljZ+oHprtxDDPHiMWVo/5dBT6PlvWX5PSwj80aBA= github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba h1:DO8NFYdcRv1dnyAINJIBm6Bw2XibtLvQniNFGzf2W8E= @@ -72,7 +64,6 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= diff --git a/v2/pkg/plugins/Makefile b/v2/pkg/plugins/Makefile deleted file mode 100644 index 0523443..0000000 --- a/v2/pkg/plugins/Makefile +++ /dev/null @@ -1,44 +0,0 @@ -##################### -# Plugins Targets -##################### - -# Note: to make a plugin compatible with a binary built in debug mode, add `-gcflags='all=-N -l'` - -PLUGIN_OS ?= linux -PLUGIN_ARCH ?= amd64 - -plugins: plugin_mysql plugin_postgres plugin_sqlite - -plugin_mysql: bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/mysql.so - -bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/mysql.so: pkg/plugins/mysql.go pkg/plugins/basesqlhandler.go - GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^ - -plugin_postgres: bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/postgres.so - -bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/postgres.so: pkg/plugins/postgres.go pkg/plugins/basesqlhandler.go - GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^ - -plugin_sqlite: bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/sqlite.so - -bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/sqlite.so: pkg/plugins/sqlite.go pkg/plugins/basesqlhandler.go - GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^ - -plugin_pam: bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/pam.so - -bin/$(PLUGIN_OS)$(PLUGIN_ARCH)/pam.so: pkg/plugins/pam_linux.go - GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^ - -plugins_darwin: plugins_darwin_amd64 plugins_darwin_arm64 - -plugins_linux_amd64: - PLUGIN_OS=linux PLUGIN_ARCH=amd64 make plugins plugin_pam - -plugins_linux_arm64: - PLUGIN_OS=linux PLUGIN_ARCH=arm64 make plugins - -plugins_darwin_amd64: - PLUGIN_OS=darwin PLUGIN_ARCH=amd64 make plugins - -plugins_darwin_arm64: - PLUGIN_OS=darwin PLUGIN_ARCH=arm64 make plugins diff --git a/v2/pkg/plugins/README.md b/v2/pkg/plugins/README.md deleted file mode 100644 index 64e4ff7..0000000 --- a/v2/pkg/plugins/README.md +++ /dev/null @@ -1,184 +0,0 @@ -# GLAuth Plugins - -This folder contains plugins; that is, backends that are not compiled in GLAuth by default. - -To quote 'Butonic' (Jörn Friedrich Dreyer): - -> Just keep the 'lightweight' in mind. - -To build either back-end, type -``` -make plugin_name -``` -where 'name' is the plugin's name; so, for instance: `make plugin_sqlite` - -To build back-ends for specific architectures, specify `PLUGIN_OS` and `PLUGIN_ARCH` -- - For instance, to build the sqlite plugin for the new Mac M1s: - ``` -make plugin_sqlite PLUGIN_OS=darwin PLUGIN_ARCH=arm64 - ``` - -## Database Plugins - -To use a database plugin, edit the configuration file (see pkg/plugins/sample-database.cfg) so that: - -``` -... -[backend] - datastore = "plugin" - plugin = "dynamic library you created using the previous 'make' command" - database = "database connection string" -... -``` -so, let's say you built the 'sqlite' plugin, you would now specify its library: `database = sqlite.so` - -### SQLite, MySQL, Postgres - -Tables: -- users, groups are self-explanatory -- includegroups store the 'includegroups' relationships -- othergroups, on the other hand, are a comma-separated list found in the users table (performance) - -Here is how to insert example data using your database's REPL (more detailed information can be found in pkg/plugins/sample-database.cfg) - -```sql -INSERT INTO groups(name, gidnumber) VALUES('superheros', 5501); -INSERT INTO groups(name, gidnumber) VALUES('svcaccts', 5502); -INSERT INTO groups(name, gidnumber) VALUES('civilians', 5503); -INSERT INTO groups(name, gidnumber) VALUES('caped', 5504); -INSERT INTO groups(name, gidnumber) VALUES('lovesailing', 5505); -INSERT INTO groups(name, gidnumber) VALUES('smoker', 5506); -INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5503, 5501); -INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5502); -INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5501); -INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('hackers', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); -INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('johndoe', 5002, 5502, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); -INSERT INTO users(name, mail, uidnumber, primarygroup, passsha256) VALUES('serviceuser', "serviceuser@example.com", 5003, 5502, '652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0'); -INSERT INTO users(name, uidnumber, primarygroup, passsha256, othergroups, custattr) VALUES('user4', 5004, 5504, '652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0', '5505,5506', '{"employeetype":["Intern","Temp"],"employeenumber":[12345,54321]}'); -INSERT INTO capabilities(userid, action, object) VALUES(5001, "search", "ou=superheros,dc=glauth,dc=com"); -INSERT INTO capabilities(userid, action, object) VALUES(5003, "search", "*"); -``` -This should be equivalent to this configuration: -```text -[[users]] - name = "hackers" - uidnumber = 5001 - primarygroup = 5501 - passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood - [[users.capabilities]] - action = "search" - object = "ou=superheros,dc=glauth,dc=com" - -[[users]] - name = "johndoe" - uidnumber = 5002 - primarygroup = 5502 - passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood - -[[users]] - name = "serviceuser" - mail = "serviceuser@example.com" - uidnumber = 5003 - passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret - primarygroup = 5502 - [[users.capabilities]] - action = "search" - object = "*" - -[[users]] - name = "user4" - uidnumber = 5003 - primarygroup = 5504 - othergroups = [5505, 5506] - passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret - [[users.customattributes]] - employeetype = ["Intern", "Temp"] - employeenumber = [12345, 54321] - -[[groups]] - name = "superheros" - gidnumber = 5501 - -[[groups]] - name = "svcaccts" - gidnumber = 5502 - -[[groups]] - name = "civilians" - gidnumber = 5503 - includegroups = [ 5501 ] - -[[groups]] - name = "caped" - gidnumber = 5504 - includegroups = [ 5502, 5501 ] -``` -and LDAP should return these `memberOf` values: -```text -uid: hackers -ou: superheros -memberOf: cn=caped,ou=groups,dc=militate,dc=com -memberOf: cn=civilians,ou=groups,dc=militate,dc=com -memberOf: cn=superheros,ou=groups,dc=militate,dc=com - -uid: johndoe -ou: svcaccts -memberOf: cn=caped,ou=groups,dc=militate,dc=com -memberOf: cn=svcaccts,ou=groups,dc=militate,dc=com - -uid: serviceuser -ou: caped -memberOf: cn=caped,ou=groups,dc=militate,dc=com - -uid: user4 -ou: caped -memberOf: cn=caped,ou=groups,dc=militate,dc=com -memberOf: cn=lovesailing,ou=groups,dc=militate,dc=com -memberOf: cn=smoker,ou=groups,dc=militate,dc=com -``` -If you have the ldap client package installed, this can be easily confirmed by running -``` -ldapsearch -H ldap://localhost:3893 -D cn=hackers,ou=superheros,dc=glauth,dc=com -w dogood -x -bdc=glauth,dc=com cn=hackers -``` -and so on. - - -### Discussion: database schema - -While GLAuth is not meant to support millions of user accounts, some decent performance is still expected! In fact, when searching through records using a database query, we should see a performance of O(log n) as opposed to, when searching through a flat config, O(n). - -While it would be friendlier to offer related attributes in `join`ed tables, we may end up re-creating a "browse" scenario unintentionally. - -For instance, when retrieving custom attributes, we could go through an attribute table: `custattr[userid, attribute, value#n]` - -However, this means that a `join` statement between the account table and the custom attribute table would yield the cartesian product of each account x attributes; we would need to iterate through the results and collate them. - -Alternatively, in Postgres and MySQL, we could rely on the database engine's built-in support for `crosstab` which pivots the second table's results into corresponding columns. This would not be supported in SQLite and would also mean building pretty nasty execution plans. - -**So, what's the decision?** - -In GLAuth 2.x, when including information that does not benefit from being normalized (e.g. custom attributes) we are following the "nosql" trend (irony!) of storing this data in a JSON structure. - -## PAM Plugin - -To authenticate against local users, edit the configuration file (see pkg/plugins/sample-pam.cfg) so that: - -``` -... -[backend] - datastore = "plugin" - plugin = "bin/pam.so" -... -``` - -When building this plugin, one must first ensure that the proper development headers are installed. For instance, on Ubuntu: -``` -sudo apt-get install libpam0g-dev -``` - -You will likely also wish to tweak the `groupWithSearchCapability` setting, to assign an appropriate secondary group. - -Then, to perform a search: -``` -ldapsearch -LLL -H ldap://localhost:3893 -D cn=,ou=,dc=glauth,dc=com -w -x -bdc=glauth,dc=com cn= -``` diff --git a/v2/pkg/plugins/bogus/Makefile b/v2/pkg/plugins/bogus/Makefile new file mode 100644 index 0000000..8322404 --- /dev/null +++ b/v2/pkg/plugins/bogus/Makefile @@ -0,0 +1,3 @@ + +release-glauth-bogus: + @echo Ignoring bogus plugin diff --git a/v2/pkg/plugins/sample-database.cfg b/v2/pkg/plugins/sample-database.cfg deleted file mode 100644 index a680f47..0000000 --- a/v2/pkg/plugins/sample-database.cfg +++ /dev/null @@ -1,82 +0,0 @@ -################# -# glauth.conf - -################# -# General configuration. -debug = true -# syslog = true -# -# Enable hot-reload of configuration on changes -# - does NOT work [ldap], [ldaps], [backend] or [api] sections -# watchconfig = true - -################# -# yubikeyclientid = "yubi-api-clientid" -# yubikeysecret = "yubi-api-secret" - -################# -# Server configuration. -# -# This is the old server-config format -# - will still work, but please use new format, shown below -# -# [frontend] -# listen = "localhost:8484" -# tls = false -# cert ="certs/server.crt" -# key = "certs/server.key" - -# This ([ldap] and [ldaps]) is the new server-config format -[ldap] - enabled = true - listen = "0.0.0.0:3893" - -[ldaps] - enabled = false - listen = "0.0.0.0:3894" - cert = "certs/server.crt" - key = "certs/server.key" - -################# -# The backend section controls the data store. -[backend] - datastore = "plugin" - # If "plugin," uncomment the line below - plugin = "bin/sqlite.so" - pluginhandler = "NewSQLiteHandler" - baseDN = "dc=glauth,dc=com" - - # // MySQL // - # Uncomment this line to configure your MySQL database connection string: - # database = "glauth:glauth@tcp(127.0.0.1:3306)/glauth" - # Creating database: - # create database glauth identified; - # grant all on glauth.* to glauth@localhost identified by 'glauth'; - # // Postgres // - # Uncomment this line to configure your Postgres database connection string: - # database = "host=127.0.0.1 port=5432 dbname=glauth user=glauth password=glauth sslmode=disable" - # Creating database: - # CREATE DATABASE ; - # CREATE USER WITH PASSWORD '' - # GRANT ALL PRIVILEGES ON DATABASE to ; - # // SQLite // - # Uncomment this line to configure your SQLite database connection string: - database = "gl.db" - - ## Configure dn format to use structures like - ## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN" - ## to help ease migrations from other LDAP systems - nameformat = "cn" - groupformat = "ou" - - ## Configure ssh-key attribute name, default is 'sshPublicKey' - # sshkeyattr = "ipaSshPubKey" - -################# -# Enable and configure the optional REST API here. -[api] - enabled = true - tls = false # enable TLS for production!! - listen = "0.0.0.0:5555" - cert = "cert.pem" - key = "key.pem" diff --git a/v2/pkg/plugins/sample-ldap-with-database.cfg b/v2/pkg/plugins/sample-ldap-with-database.cfg deleted file mode 100644 index 6636613..0000000 --- a/v2/pkg/plugins/sample-ldap-with-database.cfg +++ /dev/null @@ -1,45 +0,0 @@ -################# -# glauth.conf - -################# -# General configuration. -#debug = true -syslog = true - -################# -# Server configuration. -[ldap] - enabled = true - listen = "0.0.0.0:389" - -[ldaps] - enabled = true - listen = "0.0.0.0:636" - cert = "glauth.crt" - key = "glauth.key" - -################# -# The backend section controls the data store. -[backend] - datastore = "ldap" - servers = [ "ldaps://server1:636", "ldaps://server2:636" ] - - # Ignore SSL certificate errors when connecting to backend LDAP servers. - #insecure = true - -[helper] - enabled = true - datastore = "plugin" - plugin = "bin/sqlite.so" - pluginhandler = "NewSQLiteHandler" - database = "glh.db" - -################# -# Enable and configure the optional REST API here. -[api] - enabled = true - tls = true - listen = "localhost:5555" - cert = "glauth.crt" - key = "glauth.key" - diff --git a/v2/pkg/plugins/sample-pam.cfg b/v2/pkg/plugins/sample-pam.cfg deleted file mode 100644 index 4aafff5..0000000 --- a/v2/pkg/plugins/sample-pam.cfg +++ /dev/null @@ -1,69 +0,0 @@ -################# -# glauth.conf - -################# -# General configuration. -debug = true -# syslog = true -# -# Enable hot-reload of configuration on changes -# - does NOT work [ldap], [ldaps], [backend] or [api] sections -# watchconfig = true - -################# -# yubikeyclientid = "yubi-api-clientid" -# yubikeysecret = "yubi-api-secret" - -################# -# Server configuration. -# -# This is the old server-config format -# - will still work, but please use new format, shown below -# -# [frontend] -# listen = "localhost:8484" -# tls = false -# cert ="certs/server.crt" -# key = "certs/server.key" - -# This ([ldap] and [ldaps]) is the new server-config format -[ldap] - enabled = true - listen = "0.0.0.0:3893" - -[ldaps] - enabled = false - listen = "0.0.0.0:3894" - cert = "certs/server.crt" - key = "certs/server.key" - -################# -# The backend section controls the data store. -[backend] - datastore = "plugin" - # If "plugin," uncomment the line below - plugin = "bin/pam.so" - pluginhandler = "NewPamHandler" - baseDN = "dc=glauth,dc=com" - - # // PAM Linux // - # Configures the group whose members get search capability - groupWithSearchCapability = "shadow" - - ## Configure dn format to use structures like - ## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN" - ## to help ease migrations from other LDAP systems - nameformat = "cn" - groupformat = "ou" - - ## Configure ssh-key attribute name, default is 'sshPublicKey' - # sshkeyattr = "ipaSshPubKey" - -################# -# Enable and configure the optional REST API here. -[api] - enabled = true - tls = false # enable TLS for production!! - listen = "0.0.0.0:5555" - cert = "cert.pem" - key = "key.pem" diff --git a/v2/scripts/docker/fastat-workaround.json b/v2/scripts/docker/fastat-workaround.json deleted file mode 100644 index 74a45ad..0000000 --- a/v2/scripts/docker/fastat-workaround.json +++ /dev/null @@ -1,767 +0,0 @@ -{ - "defaultAction": "SCMP_ACT_TRACE", - "defaultErrnoRet": 1, - "archMap": [ - { - "architecture": "SCMP_ARCH_X86_64", - "subArchitectures": [ - "SCMP_ARCH_X86", - "SCMP_ARCH_X32" - ] - }, - { - "architecture": "SCMP_ARCH_AARCH64", - "subArchitectures": [ - "SCMP_ARCH_ARM" - ] - }, - { - "architecture": "SCMP_ARCH_MIPS64", - "subArchitectures": [ - "SCMP_ARCH_MIPS", - "SCMP_ARCH_MIPS64N32" - ] - }, - { - "architecture": "SCMP_ARCH_MIPS64N32", - "subArchitectures": [ - "SCMP_ARCH_MIPS", - "SCMP_ARCH_MIPS64" - ] - }, - { - "architecture": "SCMP_ARCH_MIPSEL64", - "subArchitectures": [ - "SCMP_ARCH_MIPSEL", - "SCMP_ARCH_MIPSEL64N32" - ] - }, - { - "architecture": "SCMP_ARCH_MIPSEL64N32", - "subArchitectures": [ - "SCMP_ARCH_MIPSEL", - "SCMP_ARCH_MIPSEL64" - ] - }, - { - "architecture": "SCMP_ARCH_S390X", - "subArchitectures": [ - "SCMP_ARCH_S390" - ] - } - ], - "syscalls": [ - { - "names": [ - "accept", - "accept4", - "access", - "adjtimex", - "alarm", - "bind", - "brk", - "capget", - "capset", - "chdir", - "chmod", - "chown", - "chown32", - "clock_adjtime", - "clock_adjtime64", - "clock_getres", - "clock_getres_time64", - "clock_gettime", - "clock_gettime64", - "clock_nanosleep", - "clock_nanosleep_time64", - "close", - "close_range", - "connect", - "copy_file_range", - "creat", - "dup", - "dup2", - "dup3", - "epoll_create", - "epoll_create1", - "epoll_ctl", - "epoll_ctl_old", - "epoll_pwait", - "epoll_pwait2", - "epoll_wait", - "epoll_wait_old", - "eventfd", - "eventfd2", - "execve", - "execveat", - "exit", - "exit_group", - "faccessat", - "faccessat2", - "fadvise64", - "fadvise64_64", - "fallocate", - "fanotify_mark", - "fchdir", - "fchmod", - "fchmodat", - "fchown", - "fchown32", - "fchownat", - "fcntl", - "fcntl64", - "fdatasync", - "fgetxattr", - "flistxattr", - "flock", - "fork", - "fremovexattr", - "fsetxattr", - "fstat", - "fstat64", - "fstatat64", - "fstatfs", - "fstatfs64", - "fsync", - "ftruncate", - "ftruncate64", - "futex", - "futex_time64", - "futimesat", - "getcpu", - "getcwd", - "getdents", - "getdents64", - "getegid", - "getegid32", - "geteuid", - "geteuid32", - "getgid", - "getgid32", - "getgroups", - "getgroups32", - "getitimer", - "getpeername", - "getpgid", - "getpgrp", - "getpid", - "getppid", - "getpriority", - "getrandom", - "getresgid", - "getresgid32", - "getresuid", - "getresuid32", - "getrlimit", - "get_robust_list", - "getrusage", - "getsid", - "getsockname", - "getsockopt", - "get_thread_area", - "gettid", - "gettimeofday", - "getuid", - "getuid32", - "getxattr", - "inotify_add_watch", - "inotify_init", - "inotify_init1", - "inotify_rm_watch", - "io_cancel", - "ioctl", - "io_destroy", - "io_getevents", - "io_pgetevents", - "io_pgetevents_time64", - "ioprio_get", - "ioprio_set", - "io_setup", - "io_submit", - "io_uring_enter", - "io_uring_register", - "io_uring_setup", - "ipc", - "kill", - "lchown", - "lchown32", - "lgetxattr", - "link", - "linkat", - "listen", - "listxattr", - "llistxattr", - "_llseek", - "lremovexattr", - "lseek", - "lsetxattr", - "lstat", - "lstat64", - "madvise", - "membarrier", - "memfd_create", - "mincore", - "mkdir", - "mkdirat", - "mknod", - "mknodat", - "mlock", - "mlock2", - "mlockall", - "mmap", - "mmap2", - "mprotect", - "mq_getsetattr", - "mq_notify", - "mq_open", - "mq_timedreceive", - "mq_timedreceive_time64", - "mq_timedsend", - "mq_timedsend_time64", - "mq_unlink", - "mremap", - "msgctl", - "msgget", - "msgrcv", - "msgsnd", - "msync", - "munlock", - "munlockall", - "munmap", - "nanosleep", - "newfstatat", - "_newselect", - "open", - "openat", - "openat2", - "pause", - "pidfd_open", - "pidfd_send_signal", - "pipe", - "pipe2", - "poll", - "ppoll", - "ppoll_time64", - "prctl", - "pread64", - "preadv", - "preadv2", - "prlimit64", - "pselect6", - "pselect6_time64", - "pwrite64", - "pwritev", - "pwritev2", - "read", - "readahead", - "readlink", - "readlinkat", - "readv", - "recv", - "recvfrom", - "recvmmsg", - "recvmmsg_time64", - "recvmsg", - "remap_file_pages", - "removexattr", - "rename", - "renameat", - "renameat2", - "restart_syscall", - "rmdir", - "rseq", - "rt_sigaction", - "rt_sigpending", - "rt_sigprocmask", - "rt_sigqueueinfo", - "rt_sigreturn", - "rt_sigsuspend", - "rt_sigtimedwait", - "rt_sigtimedwait_time64", - "rt_tgsigqueueinfo", - "sched_getaffinity", - "sched_getattr", - "sched_getparam", - "sched_get_priority_max", - "sched_get_priority_min", - "sched_getscheduler", - "sched_rr_get_interval", - "sched_rr_get_interval_time64", - "sched_setaffinity", - "sched_setattr", - "sched_setparam", - "sched_setscheduler", - "sched_yield", - "seccomp", - "select", - "semctl", - "semget", - "semop", - "semtimedop", - "semtimedop_time64", - "send", - "sendfile", - "sendfile64", - "sendmmsg", - "sendmsg", - "sendto", - "setfsgid", - "setfsgid32", - "setfsuid", - "setfsuid32", - "setgid", - "setgid32", - "setgroups", - "setgroups32", - "setitimer", - "setpgid", - "setpriority", - "setregid", - "setregid32", - "setresgid", - "setresgid32", - "setresuid", - "setresuid32", - "setreuid", - "setreuid32", - "setrlimit", - "set_robust_list", - "setsid", - "setsockopt", - "set_thread_area", - "set_tid_address", - "setuid", - "setuid32", - "setxattr", - "shmat", - "shmctl", - "shmdt", - "shmget", - "shutdown", - "sigaltstack", - "signalfd", - "signalfd4", - "sigprocmask", - "sigreturn", - "socket", - "socketcall", - "socketpair", - "splice", - "stat", - "stat64", - "statfs", - "statfs64", - "statx", - "symlink", - "symlinkat", - "sync", - "sync_file_range", - "syncfs", - "sysinfo", - "tee", - "tgkill", - "time", - "timer_create", - "timer_delete", - "timer_getoverrun", - "timer_gettime", - "timer_gettime64", - "timer_settime", - "timer_settime64", - "timerfd_create", - "timerfd_gettime", - "timerfd_gettime64", - "timerfd_settime", - "timerfd_settime64", - "times", - "tkill", - "truncate", - "truncate64", - "ugetrlimit", - "umask", - "uname", - "unlink", - "unlinkat", - "utime", - "utimensat", - "utimensat_time64", - "utimes", - "vfork", - "vmsplice", - "wait4", - "waitid", - "waitpid", - "write", - "writev" - ], - "action": "SCMP_ACT_ALLOW" - }, - { - "names": [ - "process_vm_readv", - "process_vm_writev", - "ptrace" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "minKernel": "4.8" - } - }, - { - "names": [ - "personality" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 0, - "value": 0, - "op": "SCMP_CMP_EQ" - } - ] - }, - { - "names": [ - "personality" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 0, - "value": 8, - "op": "SCMP_CMP_EQ" - } - ] - }, - { - "names": [ - "personality" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 0, - "value": 131072, - "op": "SCMP_CMP_EQ" - } - ] - }, - { - "names": [ - "personality" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 0, - "value": 131080, - "op": "SCMP_CMP_EQ" - } - ] - }, - { - "names": [ - "personality" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 0, - "value": 4294967295, - "op": "SCMP_CMP_EQ" - } - ] - }, - { - "names": [ - "sync_file_range2" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "arches": [ - "ppc64le" - ] - } - }, - { - "names": [ - "arm_fadvise64_64", - "arm_sync_file_range", - "sync_file_range2", - "breakpoint", - "cacheflush", - "set_tls" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "arches": [ - "arm", - "arm64" - ] - } - }, - { - "names": [ - "arch_prctl" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "arches": [ - "amd64", - "x32" - ] - } - }, - { - "names": [ - "modify_ldt" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "arches": [ - "amd64", - "x32", - "x86" - ] - } - }, - { - "names": [ - "s390_pci_mmio_read", - "s390_pci_mmio_write", - "s390_runtime_instr" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "arches": [ - "s390", - "s390x" - ] - } - }, - { - "names": [ - "open_by_handle_at" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_DAC_READ_SEARCH" - ] - } - }, - { - "names": [ - "bpf", - "clone", - "clone3", - "fanotify_init", - "fsconfig", - "fsmount", - "fsopen", - "fspick", - "lookup_dcookie", - "mount", - "move_mount", - "name_to_handle_at", - "open_tree", - "perf_event_open", - "quotactl", - "setdomainname", - "sethostname", - "setns", - "syslog", - "umount", - "umount2", - "unshare" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_ADMIN" - ] - } - }, - { - "names": [ - "clone" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 0, - "value": 2114060288, - "op": "SCMP_CMP_MASKED_EQ" - } - ], - "excludes": { - "caps": [ - "CAP_SYS_ADMIN" - ], - "arches": [ - "s390", - "s390x" - ] - } - }, - { - "names": [ - "clone" - ], - "action": "SCMP_ACT_ALLOW", - "args": [ - { - "index": 1, - "value": 2114060288, - "op": "SCMP_CMP_MASKED_EQ" - } - ], - "comment": "s390 parameter ordering for clone is different", - "includes": { - "arches": [ - "s390", - "s390x" - ] - }, - "excludes": { - "caps": [ - "CAP_SYS_ADMIN" - ] - } - }, - { - "names": [ - "clone3" - ], - "action": "SCMP_ACT_ERRNO", - "errnoRet": 38, - "excludes": { - "caps": [ - "CAP_SYS_ADMIN" - ] - } - }, - { - "names": [ - "reboot" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_BOOT" - ] - } - }, - { - "names": [ - "chroot" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_CHROOT" - ] - } - }, - { - "names": [ - "delete_module", - "init_module", - "finit_module" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_MODULE" - ] - } - }, - { - "names": [ - "acct" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_PACCT" - ] - } - }, - { - "names": [ - "kcmp", - "pidfd_getfd", - "process_madvise", - "process_vm_readv", - "process_vm_writev", - "ptrace" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_PTRACE" - ] - } - }, - { - "names": [ - "iopl", - "ioperm" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_RAWIO" - ] - } - }, - { - "names": [ - "settimeofday", - "stime", - "clock_settime" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_TIME" - ] - } - }, - { - "names": [ - "vhangup" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_TTY_CONFIG" - ] - } - }, - { - "names": [ - "get_mempolicy", - "mbind", - "set_mempolicy" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYS_NICE" - ] - } - }, - { - "names": [ - "syslog" - ], - "action": "SCMP_ACT_ALLOW", - "includes": { - "caps": [ - "CAP_SYSLOG" - ] - } - } - ] -} diff --git a/v2/scripts/release.sh b/v2/scripts/release.sh deleted file mode 100755 index ca74644..0000000 --- a/v2/scripts/release.sh +++ /dev/null @@ -1,108 +0,0 @@ -#!/usr/bin/env zsh - -# Change the values below to your own environment -# The remote host is a MacOS machine -LOCAL_ROOT=/home/chris/Projects/glauth/v2 -REMOTE_ROOT=/Users/chris/Projects/glauth/v2 -REMOTE_PATH=/Users/chris/.asdf/shims -REMOTE_GOPATH=/Users/chris/go -REMOTE_HOST=192.168.1.204 - -# Exit immediataly on error code -set -e - -info() { - echo "" - echo "################################################################################" - echo "$1" - echo "################################################################################" - echo "" -} - -remoteprepare() { - info "Preparing remote environment for execution" - ssh $REMOTE_HOST mkdir -p $REMOTE_ROOT/scripts - scp $LOCAL_ROOT/scripts/release.sh $REMOTE_HOST:$REMOTE_ROOT/scripts/release.sh - ssh $REMOTE_HOST chmod +x $REMOTE_ROOT/scripts/release.sh -} - -localmake() { - branch="$1" - info "Building local $branch environment" - cd $LOCAL_ROOT - git checkout $branch - git pull - [[ -d bin ]] && rm -rf bin - make release - make plugins -} - -requestremotemake() { - branch="$1" - info "Requesting remote $branch build" - ssh -t $REMOTE_HOST GOPATH=$REMOTE_GOPATH PATH=$REMOTE_PATH:\$PATH $REMOTE_ROOT/scripts/release.sh $branch iamremote -} - -remotemake() { - branch="$1" - info "Building remote $branch environment" - cd $REMOTE_ROOT - git checkout $branch - git pull - [[ -d bin ]] && rm -rf bin - make release_darwin - make plugins_darwin -} - -retrieveremote() { - info "Retrieving remote artifacts" - for pkg in $(ssh $REMOTE_HOST ls $REMOTE_ROOT/bin); do - for artefact in $(ssh $REMOTE_HOST ls $REMOTE_ROOT/bin/$pkg); do - mkdir -p $LOCAL_ROOT/bin/$pkg - scp $REMOTE_HOST:$REMOTE_ROOT/bin/$pkg/$artefact $LOCAL_ROOT/bin/$pkg/$artefact - echo $artefact - done - done -} - -archivelocal() { - info "Archiving local artifacts" - cd bin - [[ -f *.zip ]] && rm -f *.zip - for pkg in *; do - echo $pkg - cd $pkg - zip ../$pkg.zip * - cd .. - done - cd .. -} - -ACT="$1" -[[ "$2" == "iamremote" ]] && ACT=${ACT}remote - -case $ACT in - dev) - localmake dev - remoteprepare - requestremotemake dev - retrieveremote - archivelocal - ;; - master) - localmake master - remoteprepare - requestremotemake master - retrieveremote - archivelocal - ;; - devremote) - remotemake dev - ;; - masterremote) - remotemake master - ;; - *) - echo "Select dev or master." - ;; -esac diff --git a/v2/scripts/ship-docker-build.sh b/v2/scripts/ship-docker-build.sh index 429fc03..c7b3550 100755 --- a/v2/scripts/ship-docker-build.sh +++ b/v2/scripts/ship-docker-build.sh @@ -82,6 +82,17 @@ push_to_docker() { push_profile_to_docker plugins $tag } +clear +cat <