Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Testing privilege separation settings #113

Draft
wants to merge 11 commits into
base: master
Choose a base branch
from
Draft

Testing privilege separation settings #113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
6ac6ebd
Testing privilege separation settings
gStart9 Sep 20, 2023
0e4d294
Reorganize and adduser create home
gStart9 Sep 26, 2023
058742f
Rearrange adduser switch for suppolemental groups
gStart9 Sep 26, 2023
afdafcf
Switch to useradd for better supplemental group support
gStart9 Sep 26, 2023
e55b51a
More touchups
gStart9 Sep 26, 2023
5a04c98
Merge branch 'master' of https://github.com/joinmarket-webui/jam-dock…
gStart9 Nov 8, 2023
d32f684
yank apt-transport-https
gStart9 Nov 8, 2023
862f7ca
Feat/privilege separation (#1)
gStart9 Nov 9, 2023
6bcb7ed
etc & Make /data
gStart9 Dec 21, 2023
b41792e
Merge branch 'joinmarket-webui:master' into master
gStart9 Dec 21, 2023
eedea49
Merge branch 'master' into feat/privilege_separation
gStart9 Dec 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions standalone/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,14 @@ LABEL server-version=$JM_SERVER_REPO_REF

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN addgroup --system tor \
&& adduser --system --disabled-login --ingroup tor --gecos 'tor user' tor \
RUN adduser --uid 704704 --system --group --gecos 'tor user' tor \
&& addgroup --gid 701234 --system joinmarket \
&& useradd --uid 7012347 --system -g joinmarket --groups tor --comment 'jmwalletd user' --home-dir /data jm-w \
&& useradd --uid 7012348 --system -g joinmarket --comment 'ob-watcher user' jm-ob \
&& mkdir /data && chown :701234 /data \
&& sed "s|http://|https://|" /etc/apt/sources.list \
&& apt-get update \
&& apt-get install -qq --no-install-recommends --no-install-suggests -y gnupg curl apt-transport-https ca-certificates \
Copy link
Author

@gStart9 gStart9 Nov 8, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As of apt 1.5, the package apt-transport-https is no longer required because https:// is supported out of the box.
Reference: https://packages.debian.org/bullseye/apt-transport-https

This is a dummy transitional package - https support has been moved into the apt package in 1.5. It can be safely removed."

Apt is currently at 2.6.

&& apt-get install -qq --no-install-recommends --no-install-suggests -y gnupg curl ca-certificates \
# add nginx debian repo
&& curl --silent https://nginx.org/keys/nginx_signing.key | \
gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg > /dev/null \
Expand All @@ -96,6 +100,8 @@ RUN addgroup --system tor \
deb.torproject.org-keyring \
# ui dependencies
nginx \
# privilege separation dependency:
sudo \
# cleanup
&& apt-get clean \
&& rm --recursive --force /var/lib/apt/lists/*
Expand All @@ -104,9 +110,9 @@ COPY --from=dinit-builder /usr/src/dinit/dinit-bin/sbin /sbin
COPY --from=ui-builder /usr/src/jam/build /app
COPY --from=server-builder /usr/src/joinmarket-clientserver /src

ENV DATADIR /root/.joinmarket
ENV DATADIR /data/.joinmarket
ENV CONFIG ${DATADIR}/joinmarket.cfg
ENV DEFAULT_CONFIG /root/default.cfg
ENV DEFAULT_CONFIG /data/default.cfg
ENV PATH /src/scripts:$PATH

WORKDIR /src
Expand Down
2 changes: 1 addition & 1 deletion standalone/dinit-conf/jmwalletd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
type = process
command = python3 jmwalletd.py
command = sudo -u jm-w python3 jmwalletd.py
working-dir = /src/scripts
depends-on = tor
restart = true
Expand Down
2 changes: 1 addition & 1 deletion standalone/dinit-conf/ob-watcher
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
type = process
command = python3 ob-watcher.py --host=127.0.0.1
command = sudo -u jm-ob python3 ob-watcher.py --host=127.0.0.1
working-dir = /src/scripts/obwatch
depends-on = tor
restart = true
Expand Down
3 changes: 3 additions & 0 deletions standalone/torrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,6 @@ Log warn stderr
SOCKSPort 9050 IsolateDestAddr IsolateDestPort
ControlPort 9051
CookieAuthentication 1
CookieAuthFile /home/tor/.tor/control_auth_cookie
CookieAuthFileGroupReadable 1
DataDirectoryGroupReadable 1