akritikos
f5a5204b75
- Introduced a new Containerfile to build a MariaDB image with direct LDAP PAM support. - Implemented a custom PAM module (`pam_ldap_direct.so`) built from the PADL source to avoid dependencies on `libpam-ldap` and `nslcd`. - Updated the entrypoint script to dynamically generate the PAM configuration file (`/etc/pam_ldap.conf`) based on environment variables. - Added a README.md to document the image usage, configuration, and build process. - Created a test suite to validate the image build and entrypoint behavior, ensuring proper handling of environment variables and configuration generation. - Configured health checks and ensured the stock MariaDB entrypoint and lifecycle are preserved.
75 lines
3.0 KiB
Docker
75 lines
3.0 KiB
Docker
ARG MARIADB_VERSION=13.0.2
|
|
FROM mariadb:${MARIADB_VERSION} AS base
|
|
|
|
FROM base AS pam-build
|
|
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
build-essential ca-certificates curl libcrypt-dev libldap-dev libpam0g-dev libsasl2-dev perl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build/pam_ldap
|
|
RUN curl --fail --show-error --silent --location --proto '=https' --tlsv1.2 \
|
|
https://codeload.github.com/PADL/pam_ldap/tar.gz/656448f091cbeb9efb3ece08e6868e40b8e7b6f8 \
|
|
--output /tmp/pam_ldap.tar.gz \
|
|
&& printf '%s %s\n' \
|
|
1aa622e85621b9018025e3483956d854566a5bc0636a4e8d9d005093f02dd16b \
|
|
/tmp/pam_ldap.tar.gz | sha256sum -c - \
|
|
&& tar -xzf /tmp/pam_ldap.tar.gz --strip-components=1 \
|
|
&& CFLAGS='-O2 -fPIC -std=gnu89' ./configure \
|
|
--prefix=/usr/local \
|
|
--with-ldap-lib=openldap \
|
|
--with-ldap-conf-file=/etc/pam_ldap.conf \
|
|
--enable-ssl \
|
|
&& PERL5LIB=/build/pam_ldap make -j2 \
|
|
&& nm -D pam_ldap.so | grep -E ' T pam_sm_authenticate(@|$)' \
|
|
&& nm -D pam_ldap.so | grep -E ' T pam_sm_acct_mgmt(@|$)' \
|
|
&& grep -F '#define HAVE_LDAP_INITIALIZE 1' config.h \
|
|
&& grep -F '#define HAVE_LDAP_START_TLS_S 1' config.h
|
|
|
|
FROM base
|
|
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
ca-certificates libcrypt1 libldap2 libpam0g util-linux \
|
|
&& command -v setpriv \
|
|
&& update-ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=pam-build --chmod=0755 /build/pam_ldap/pam_ldap.so /usr/local/lib/security/pam_ldap_direct.so
|
|
COPY --from=pam-build /build/pam_ldap/COPYING /build/pam_ldap/COPYING.LIB /usr/share/doc/pam-ldap-direct/
|
|
|
|
RUN set -eu; \
|
|
module=/usr/local/lib/security/pam_ldap_direct.so; \
|
|
ldd "$module" > /tmp/pam-ldap-dependencies; \
|
|
if grep -q 'not found' /tmp/pam-ldap-dependencies; then \
|
|
cat /tmp/pam-ldap-dependencies >&2; \
|
|
exit 1; \
|
|
fi; \
|
|
grep -F 'libldap' /tmp/pam-ldap-dependencies; \
|
|
rm /tmp/pam-ldap-dependencies; \
|
|
plugin=/usr/lib/mysql/plugin/auth_pam.so; \
|
|
helper_dir=/usr/lib/mysql/plugin/auth_pam_tool_dir; \
|
|
helper="$helper_dir/auth_pam_tool"; \
|
|
test -f "$plugin" || { echo "Missing MariaDB auth_pam plugin: $plugin" >&2; exit 1; }; \
|
|
test -f "$helper" || { echo "Missing MariaDB PAM helper: $helper" >&2; exit 1; }; \
|
|
chown root:mysql "$helper_dir" "$helper"; \
|
|
chmod 0750 "$helper_dir"; \
|
|
chmod 4750 "$helper"; \
|
|
gosu mysql test -x "$helper"
|
|
|
|
RUN mkdir -p /etc/mysql/image.conf.d /etc/mysql/site.conf.d \
|
|
&& printf '%s\n' \
|
|
'!includedir /etc/mysql/image.conf.d/' \
|
|
'!includedir /etc/mysql/site.conf.d/' >> /etc/mysql/mariadb.cnf
|
|
|
|
COPY conf.d/ /etc/mysql/image.conf.d/
|
|
COPY --chmod=0644 pam.d/mariadb /etc/pam.d/mariadb
|
|
COPY --chmod=0755 docker-entrypoint.sh /usr/local/bin/ldap-entrypoint.sh
|
|
|
|
HEALTHCHECK --interval=10s --timeout=5s --retries=5 --start-period=15s \
|
|
CMD healthcheck.sh --connect --innodb_initialized || exit 1
|
|
|
|
ENTRYPOINT ["ldap-entrypoint.sh"]
|
|
CMD ["mariadbd"]
|