Skip to content

Conversation

@ijc
Copy link
Contributor

@ijc ijc commented Mar 11, 2019

Somewhere between Thursday and Friday last week the docker:test-dind image was updated from an alpine 3.9.0 base to 3.9.2. This broke the use of chsh in e2e/testdata/Dockerfile.connhelper-ssh:

Step 1/6 : FROM docker:test-dind
test-dind: Pulling from library/docker
Digest: sha256:ec353956a21300964a7eb2b620a742c2730f618f4df35f60609b30969cd83ce8
Status: Downloaded newer image for docker:test-dind
 ---> 85e924caedbd
Step 2/6 : RUN apk --no-cache add shadow openssh-server &&   groupadd -f docker &&   useradd -m penguin &&   usermod -aG docker penguin &&   usermod -p $(head -c32 /dev/urandom | base64) penguin &&   chsh -s /bin/sh penguin &&   ssh-keygen -A
 ---> Running in 35e0398d93bd
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
(1/5) Installing openssh-keygen (7.9_p1-r4)
(2/5) Installing openssh-server-common (7.9_p1-r4)
(3/5) Installing openssh-server (7.9_p1-r4)
(4/5) Installing linux-pam (1.3.0-r0)
(5/5) Installing shadow (4.5-r0)
Executing busybox-1.29.3-r10.trigger
OK: 22 MiB in 44 packages
�[91mCreating mailbox file: No such file or directory
�[0m�[91mPassword: �[0m�[91mchsh: PAM: Authentication token manipulation error
�[0mService 'engine' failed to build: The command '/bin/sh -c apk --no-cache add shadow openssh-server &&   groupadd -f docker &&   useradd -m penguin &&   usermod -aG docker penguin &&   usermod -p $(head -c32 /dev/urandom | base64) penguin &&   chsh -s /bin/sh penguin &&   ssh-keygen -A' returned a non-zero code: 1
docker.Makefile:152: recipe for target 'test-e2e-connhelper-ssh' failed
make: *** [test-e2e-connhelper-ssh] Error 1

(this seems to relate to root's entry in /etc/shadow changing from root:::0:::::\nbin:!::0::::: to root:!::0:::::\nbin:!::0:::::).

Avoid this by just using the --shell option to useradd instead.

Also simplify things by using --password instead of usermod -p (even though this was not broken) and also spell out -m in full as --create-home for clarity.

Ian Campbell added 3 commits March 11, 2019 14:25
... in preference to `chsh`, since in recent alpine 3.9.2 images that can fail
with:

    Password: chsh: PAM: Authentication token manipulation error

Which seems to relate to the use of `!` as the password for `root` in `/etc/shadow`gq

Signed-off-by: Ian Campbell <[email protected]>
... for improved readability

Signed-off-by: Ian Campbell <[email protected]>
@codecov-io
Copy link

Codecov Report

Merging #1728 into master will increase coverage by <.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #1728      +/-   ##
==========================================
+ Coverage   56.14%   56.14%   +<.01%     
==========================================
  Files         306      306              
  Lines       21031    21028       -3     
==========================================
  Hits        11807    11807              
+ Misses       8369     8366       -3     
  Partials      855      855

Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thaJeztah
Copy link
Member

we should probably cherry-pick this into the release-branch as well

Copy link
Contributor

@silvin-lubecki silvin-lubecki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants