Add prof of concept none pivilage execution

Use 'DS_PORT' env to use custom https port
  sudo docker run -e DS_PORT=1234 -itd -p80:1234  \
  onlyoffice/documentserver

Dockerfile

@@ -3,6 +3,8 @@ LABEL maintainer Ascensio System SIA <support@onlyoffice.com>
 
 ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8 DEBIAN_FRONTEND=noninteractive
 
+ARG ONLYOFFICE_VALUE=onlyoffice
+
 RUN echo "#!/bin/sh\nexit 0" > /usr/sbin/policy-rc.d && \
     apt-get -y update && \
     apt-get -yq install wget apt-transport-https curl locales && \
@@ -42,9 +44,9 @@ RUN echo "#!/bin/sh\nexit 0" > /usr/sbin/policy-rc.d && \
         supervisor \
         xvfb \
         zlib1g && \
-    sudo -u postgres psql -c "CREATE DATABASE onlyoffice;" && \
-    sudo -u postgres psql -c "CREATE USER onlyoffice WITH password 'onlyoffice';" && \
-    sudo -u postgres psql -c "GRANT ALL privileges ON DATABASE onlyoffice TO onlyoffice;" && \ 
+    sudo -u postgres psql -c "CREATE DATABASE $ONLYOFFICE_VALUE;" && \
+    sudo -u postgres psql -c "CREATE USER $ONLYOFFICE_VALUE WITH password '$ONLYOFFICE_VALUE';" && \
+    sudo -u postgres psql -c "GRANT ALL privileges ON DATABASE $ONLYOFFICE_VALUE TO $ONLYOFFICE_VALUE;" && \ 
     service postgresql stop && \
     service redis-server stop && \
     service rabbitmq-server stop && \
@@ -52,24 +54,27 @@ RUN echo "#!/bin/sh\nexit 0" > /usr/sbin/policy-rc.d && \
     service nginx stop && \
     rm -rf /var/lib/apt/lists/*
 
-COPY config /app/onlyoffice/setup/config/
-COPY run-document-server.sh /app/onlyoffice/run-document-server.sh
+COPY config /app/ds/setup/config/
+COPY run-document-server.sh /app/ds/run-document-server.sh
 
 EXPOSE 80 443
 
 ARG REPO_URL="deb http://download.onlyoffice.com/repo/debian squeeze main"
-ARG PRODUCT_NAME=onlyoffice-documentserver
+ARG COMPANY_NAME=onlyoffice
+ARG PRODUCT_NAME=documentserver
 
-RUN echo "$REPO_URL" | tee /etc/apt/sources.list.d/onlyoffice.list && \
+ENV COMPANY_NAME=$COMPANY_NAME
+
+RUN echo "$REPO_URL" | tee /etc/apt/sources.list.d/ds.list && \
     apt-get -y update && \
     service postgresql start && \
-    apt-get -yq install $PRODUCT_NAME && \
+    apt-get -yq install $COMPANY_NAME-$PRODUCT_NAME && \
     service postgresql stop && \
     service supervisor stop && \
-    chmod 755 /app/onlyoffice/*.sh && \
-    rm -rf /var/log/onlyoffice && \
+    chmod 755 /app/ds/*.sh && \
+    rm -rf /var/log/$COMPANY_NAME && \
     rm -rf /var/lib/apt/lists/*
 
-VOLUME /var/log/onlyoffice /var/lib/onlyoffice /var/www/onlyoffice/Data /var/lib/postgresql /usr/share/fonts/truetype/custom
+VOLUME /var/log/$COMPANY_NAME /var/lib/$COMPANY_NAME /var/www/$COMPANY_NAME/Data /var/lib/postgresql /usr/share/fonts/truetype/custom
 
-ENTRYPOINT /app/onlyoffice/run-document-server.sh
+ENTRYPOINT /app/ds/run-document-server.sh

Makefile

@@ -1,8 +1,9 @@
 COMPANY_NAME ?= onlyoffice
-GIT_BRANCH ?= origin/develop
+GIT_BRANCH ?= develop
 PRODUCT_NAME ?= documentserver-ie
 PRODUCT_VERSION ?= 0.0.0
 BUILD_NUMBER ?= 0
+ONLYOFFICE_VALUE ?= onlyoffice
 
 PACKAGE_VERSION := $(PRODUCT_VERSION)-$(BUILD_NUMBER)
 
@@ -11,36 +12,55 @@ REPO_URL := "deb [trusted=yes] http://repo-doc-onlyoffice-com.s3.amazonaws.com/u
 UPDATE_LATEST := false
 
 ifneq (,$(findstring develop,$(GIT_BRANCH)))
-DOCKER_TAGS += $(subst -,.,$(PACKAGE_VERSION))
+DOCKER_TAG += $(subst -,.,$(PACKAGE_VERSION))
 DOCKER_TAGS += latest
 else ifneq (,$(findstring release,$(GIT_BRANCH)))
-DOCKER_TAGS += $(subst -,.,$(PACKAGE_VERSION))
+DOCKER_TAG += $(subst -,.,$(PACKAGE_VERSION))
 else ifneq (,$(findstring hotfix,$(GIT_BRANCH)))
-DOCKER_TAGS += $(subst -,.,$(PACKAGE_VERSION))
+DOCKER_TAG += $(subst -,.,$(PACKAGE_VERSION))
 else
-DOCKER_TAGS += $(subst -,.,$(PACKAGE_VERSION))-$(subst /,-,$(GIT_BRANCH))
+DOCKER_TAG += $(subst -,.,$(PACKAGE_VERSION))-$(subst /,-,$(GIT_BRANCH))
 endif
 
+DOCKER_TAGS += $(DOCKER_TAG)
+
 DOCKER_REPO = $(COMPANY_NAME)/4testing-$(PRODUCT_NAME)
 
 COLON := __colon__
 DOCKER_TARGETS := $(foreach TAG,$(DOCKER_TAGS),$(DOCKER_REPO)$(COLON)$(TAG))
 
-.PHONY: all clean clean-docker deploy docker
+DOCKER_ARCH := $(COMPANY_NAME)-$(PRODUCT_NAME)_$(PACKAGE_VERSION).tar.gz
+
+.PHONY: all clean clean-docker deploy docker publish
 
 $(DOCKER_TARGETS): $(DEB_REPO_DATA)
 
-	docker build --build-arg REPO_URL=$(REPO_URL) --build-arg PRODUCT_NAME=$(COMPANY_NAME)-$(PRODUCT_NAME) -t $(subst $(COLON),:,$@) . &&\
+	docker build \
+		--build-arg REPO_URL=$(REPO_URL) \
+		--build-arg COMPANY_NAME=$(COMPANY_NAME) \
+		--build-arg PRODUCT_NAME=$(PRODUCT_NAME) \
+		--build-arg ONLYOFFICE_VALUE=$(ONLYOFFICE_VALUE) \
+		-t $(subst $(COLON),:,$@) . &&\
 	mkdir -p $$(dirname $@) &&\
 	echo "Done" > $@
 
+$(DOCKER_ARCH): $(DOCKER_TARGETS)
+	docker save $(DOCKER_REPO):$(DOCKER_TAG) | \
+		gzip > $@
+
 all: $(DOCKER_TARGETS)
 
 clean:
-	rm -rfv $(DOCKER_TARGETS)
+	rm -rfv $(DOCKER_TARGETS) $(DOCKER_ARCH)
 		
 clean-docker:
 	docker rmi -f $$(docker images -q $(COMPANY_NAME)/*) || exit 0
 
 deploy: $(DOCKER_TARGETS)
 	$(foreach TARGET,$(DOCKER_TARGETS),docker push $(subst $(COLON),:,$(TARGET));)
+
+publish: $(DOCKER_ARCH)
+	aws s3 cp \
+		$(DOCKER_ARCH) \
+		s3://repo-doc-onlyoffice-com.s3.amazonaws.com/docker/amd64/ \
+		--acl public-read

config/nginx/nginx

@@ -0,0 +1,196 @@
+#!/bin/sh
+
+### BEGIN INIT INFO
+# Provides:       nginx
+# Required-Start:    $local_fs $remote_fs $network $syslog $named
+# Required-Stop:     $local_fs $remote_fs $network $syslog $named
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: starts the nginx web server
+# Description:       starts nginx using start-stop-daemon
+### END INIT INFO
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+DAEMON=/usr/sbin/nginx
+NAME=nginx
+DESC=nginx
+
+# Include nginx defaults if available
+if [ -r /etc/default/nginx ]; then
+        . /etc/default/nginx
+fi
+
+STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/5/KILL/5}"
+
+test -x $DAEMON || exit 0
+
+. /lib/init/vars.sh
+. /lib/lsb/init-functions
+
+# Try to extract nginx pidfile
+PID=$(cat /etc/nginx/nginx.conf | grep -Ev '^\s*#' | awk 'BEGIN { RS="[;{}]" } { if ($1 == "pid") print $2 }' | head -n1)
+if [ -z "$PID" ]; then
+        PID=/tmp/nginx.pid
+fi
+
+if [ -n "$ULIMIT" ]; then
+        # Set ulimit if it is set in /etc/default/nginx
+        ulimit $ULIMIT
+fi
+
+start_nginx() {
+        # Start the daemon/service
+        #
+        # Returns:
+        #   0 if daemon has been started
+        #   1 if daemon was already running
+        #   2 if daemon could not be started
+        start-stop-daemon --start --quiet --pidfile $PID --chuid www-data:www-data --exec $DAEMON --test > /dev/null \
+                || return 1
+        start-stop-daemon --start --quiet --pidfile $PID --chuid www-data:www-data --exec $DAEMON -- \
+                $DAEMON_OPTS 2>/dev/null \
+                || return 2
+}
+
+test_config() {
+        # Test the nginx configuration
+        $DAEMON -t $DAEMON_OPTS >/dev/null 2>&1
+}
+
+stop_nginx() {
+        # Stops the daemon/service
+        #
+        # Return
+        #   0 if daemon has been stopped
+        #   1 if daemon was already stopped
+        #   2 if daemon could not be stopped
+        #   other if a failure occurred
+        start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PID --name $NAME
+        RETVAL="$?"
+        sleep 1
+        return "$RETVAL"
+}
+
+reload_nginx() {
+        # Function that sends a SIGHUP to the daemon/service
+        start-stop-daemon --stop --signal HUP --quiet --pidfile $PID --name $NAME
+        return 0
+}
+
+rotate_logs() {
+        # Rotate log files
+        start-stop-daemon --stop --signal USR1 --quiet --pidfile $PID --name $NAME
+        return 0
+}
+
+upgrade_nginx() {
+        # Online upgrade nginx executable
+        # http://nginx.org/en/docs/control.html
+        #
+        # Return
+        #   0 if nginx has been successfully upgraded
+        #   1 if nginx is not running
+        #   2 if the pid files were not created on time
+        #   3 if the old master could not be killed
+        if start-stop-daemon --stop --signal USR2 --quiet --pidfile $PID --name $NAME; then
+                # Wait for both old and new master to write their pid file
+                while [ ! -s "${PID}.oldbin" ] || [ ! -s "${PID}" ]; do
+                        cnt=`expr $cnt + 1`
+                        if [ $cnt -gt 10 ]; then
+                                return 2
+                        fi
+                        sleep 1
+                done
+                # Everything is ready, gracefully stop the old master
+                if start-stop-daemon --stop --signal QUIT --quiet --pidfile "${PID}.oldbin" --name $NAME; then
+                        return 0
+                else
+                        return 3
+                fi
+        else
+                return 1
+        fi
+}
+
+case "$1" in
+        start)
+                log_daemon_msg "Starting $DESC" "$NAME"
+                start_nginx
+                case "$?" in
+                        0|1) log_end_msg 0 ;;
+                        2)   log_end_msg 1 ;;
+                esac
+                ;;
+        stop)
+                log_daemon_msg "Stopping $DESC" "$NAME"
+                stop_nginx
+                case "$?" in
+                        0|1) log_end_msg 0 ;;
+                        2)   log_end_msg 1 ;;
+                esac
+                ;;
+        restart)
+                log_daemon_msg "Restarting $DESC" "$NAME"
+
+                # Check configuration before stopping nginx
+                if ! test_config; then
+                        log_end_msg 1 # Configuration error
+                        exit $?
+                fi
+
+                stop_nginx
+                case "$?" in
+                        0|1)
+                                start_nginx
+                                case "$?" in
+                                        0) log_end_msg 0 ;;
+                                        1) log_end_msg 1 ;; # Old process is still running
+                                        *) log_end_msg 1 ;; # Failed to start
+                                esac
+                                ;;
+                        *)
+                                # Failed to stop
+                                log_end_msg 1
+                                ;;
+                esac
+                ;;
+        reload|force-reload)
+                log_daemon_msg "Reloading $DESC configuration" "$NAME"
+
+                # Check configuration before stopping nginx
+                #
+                # This is not entirely correct since the on-disk nginx binary
+                # may differ from the in-memory one, but that's not common.
+                # We prefer to check the configuration and return an error
+                # to the administrator.
+                if ! test_config; then
+                        log_end_msg 1 # Configuration error
+                        exit $?
+                fi
+
+                reload_nginx
+                log_end_msg $?
+                ;;
+        configtest|testconfig)
+                log_daemon_msg "Testing $DESC configuration"
+                test_config
+                log_end_msg $?
+                ;;
+        status)
+                status_of_proc -p $PID "$DAEMON" "$NAME" && exit 0 || exit $?
+                ;;
+        upgrade)
+                log_daemon_msg "Upgrading binary" "$NAME"
+                upgrade_nginx
+                log_end_msg $?
+                ;;
+        rotate)
+                log_daemon_msg "Re-opening $DESC log files" "$NAME"
+                rotate_logs
+                log_end_msg $?
+                ;;
+        *)
+                echo "Usage: $NAME {start|stop|restart|reload|force-reload|status|configtest|rotate|upgrade}" >&2
+                exit 3
+                ;;
+esac

config/nginx/nginx.conf

@@ -0,0 +1,63 @@
+user www-data;
+worker_processes 1;
+pid /tmp/nginx.pid;
+
+events {
+        worker_connections 524288;
+        # multi_accept on;
+}
+
+http {
+
+        ##
+        # Basic Settings
+        ##
+
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 65;
+        types_hash_max_size 2048;
+        # server_tokens off;
+
+        # server_names_hash_bucket_size 64;
+        # server_name_in_redirect off;
+
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        ##
+        # SSL Settings
+        ##
+
+        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
+        ssl_prefer_server_ciphers on;
+
+        ##
+        # Logging Settings
+        ##
+
+        access_log off;
+        error_log /var/log/nginx/error.log;
+
+        ##
+        # Gzip Settings
+        ##
+
+        gzip on;
+        gzip_disable "msie6";
+
+        # gzip_vary on;
+        # gzip_proxied any;
+        # gzip_comp_level 6;
+        # gzip_buffers 16 8k;
+        # gzip_http_version 1.1;
+        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        ##
+        # Virtual Host Configs
+        ##
+
+        include /etc/nginx/conf.d/*.conf;
+        include /etc/nginx/sites-enabled/*;
+}

config/supervisor/supervisor

@@ -30,8 +30,8 @@ DESC=supervisor
 
 test -x $DAEMON || exit 0
 
-LOGDIR=/var/log/supervisor
-PIDFILE=/var/run/$NAME.pid
+LOGDIR=/tmp
+PIDFILE=/tmp/$NAME.pid
 PS_COUNT=0
 DODTIME=5                   # Time to wait for the server to die, in seconds
                             # If this value is set too low you might not
@@ -101,7 +101,7 @@ case "$1" in
             rm -f "$PIDFILE"
         fi
 	echo -n "Starting $DESC: "
-	start-stop-daemon --start --quiet --pidfile $PIDFILE \
+	start-stop-daemon --start --quiet --chuid ds:ds --pidfile $PIDFILE \
 		--startas $DAEMON -- $DAEMON_OPTS
 	test -f $PIDFILE || sleep 1
         if running ; then
@@ -152,7 +152,7 @@ case "$1" in
     echo -n "Restarting $DESC: "
     start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE
 	[ -n "$DODTIME" ] && sleep $DODTIME
-	start-stop-daemon --start --quiet --pidfile $PIDFILE \
+	start-stop-daemon --start --quiet --chuid ds:ds --pidfile $PIDFILE \
 		--startas $DAEMON -- $DAEMON_OPTS
 	echo "$NAME."
 	;;

config/supervisor/supervisord.conf

@@ -4,9 +4,9 @@
 port = 127.0.0.1:9001
 
 [supervisord]
-logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
-pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
-childlogdir=/var/log/supervisor            ; ('AUTO' child log dir, default $TEMP)
+logfile=/tmp/supervisord.log ; (main log file;default $CWD/supervisord.log)
+pidfile=/tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+childlogdir=/tmp            ; ('AUTO' child log dir, default $TEMP)
 
 ; the below section must remain in the config file for RPC
 ; (supervisorctl/web interface) to work, additional interfaces may be

docker-compose.yml

@@ -12,6 +12,10 @@ services:
       - AMQP_SERVER_URL=amqp://guest:guest@onlyoffice-rabbitmq
       - REDIS_SERVER_HOST=onlyoffice-redis
       - REDIS_SERVER_PORT=6379
+      # Uncomment strings below to enable the JSON Web Token validation.
+      #- JWT_ENABLED=true
+      #- JWT_SECRET=secret
+      #- JWT_HEADER=Authorization
     stdin_open: true
     restart: always
     networks:

run-document-server.sh

@@ -3,13 +3,13 @@
 # Define '**' behavior explicitly
 shopt -s globstar
 
-APP_DIR="/var/www/onlyoffice/documentserver"
-DATA_DIR="/var/www/onlyoffice/Data"
-LOG_DIR="/var/log/onlyoffice"
+APP_DIR="/var/www/${COMPANY_NAME}/documentserver"
+DATA_DIR="/var/www/${COMPANY_NAME}/Data"
+LOG_DIR="/var/log/${COMPANY_NAME}"
 DS_LOG_DIR="${LOG_DIR}/documentserver"
-LIB_DIR="/var/lib/onlyoffice"
+LIB_DIR="/var/lib/${COMPANY_NAME}"
 DS_LIB_DIR="${LIB_DIR}/documentserver"
-CONF_DIR="/etc/onlyoffice/documentserver"
+CONF_DIR="/etc/${COMPANY_NAME}/documentserver"
 
 ONLYOFFICE_DATA_CONTAINER=${ONLYOFFICE_DATA_CONTAINER:-false}
 ONLYOFFICE_DATA_CONTAINER_HOST=${ONLYOFFICE_DATA_CONTAINER_HOST:-localhost}
@@ -23,7 +23,7 @@ SSL_DHPARAM_PATH=${SSL_DHPARAM_PATH:-${SSL_CERTIFICATES_DIR}/dhparam.pem}
 SSL_VERIFY_CLIENT=${SSL_VERIFY_CLIENT:-off}
 ONLYOFFICE_HTTPS_HSTS_ENABLED=${ONLYOFFICE_HTTPS_HSTS_ENABLED:-true}
 ONLYOFFICE_HTTPS_HSTS_MAXAGE=${ONLYOFFICE_HTTPS_HSTS_MAXAGE:-31536000}
-SYSCONF_TEMPLATES_DIR="/app/onlyoffice/setup/config"
+SYSCONF_TEMPLATES_DIR="/app/ds/setup/config"
 
 NGINX_CONFD_PATH="/etc/nginx/conf.d";
 NGINX_ONLYOFFICE_PATH="${CONF_DIR}/nginx"
@@ -48,6 +48,8 @@ JSON="${JSON_BIN} -q -f ${ONLYOFFICE_DEFAULT_CONFIG}"
 JSON_LOG="${JSON_BIN} -q -f ${ONLYOFFICE_LOG4JS_CONFIG}"
 JSON_EXAMPLE="${JSON_BIN} -q -f ${ONLYOFFICE_EXAMPLE_CONFIG}"
 
+DS_PORT=${DS_PORT:-80}
+
 LOCAL_SERVICES=()
 
 PG_ROOT=/var/lib/postgresql
@@ -109,6 +111,7 @@ parse_rabbitmq_url(){
   # extract the path (if any)
   local path="$(echo $url | grep / | cut -d/ -f2-)"
 
+  AMQP_SERVER_PROTO=${proto:0:-3}
   AMQP_SERVER_HOST=$host
   AMQP_SERVER_USER=$user
   AMQP_SERVER_PASS=$pass
@@ -176,6 +179,15 @@ update_rabbitmq_setting(){
     else
       ${JSON} -I -e "delete this.activemq.connectOptions.password"
     fi
+
+    case "${AMQP_SERVER_PROTO}" in
+      amqp+ssl|amqps)
+        ${JSON} -I -e "this.activemq.connectOptions.transport = 'tls'"
+        ;;
+      *)
+        ${JSON} -I -e "delete this.activemq.connectOptions.transport"
+        ;;
+    esac 
   fi
 }
 
@@ -276,6 +288,8 @@ update_nginx_settings(){
     fi
   else
     ln -sf ${NGINX_ONLYOFFICE_PATH}/ds.conf.tmpl ${NGINX_ONLYOFFICE_CONF}
+    # set up default listening port
+    sed 's,\(listen.\+:\)\([0-9]\+\)\(.*;\),'"\1${DS_PORT}\3"',' -i ${NGINX_ONLYOFFICE_CONF}
   fi
 
   # check if ipv6 supported otherwise remove it from nginx config
@@ -293,6 +307,10 @@ update_supervisor_settings(){
   cp ${SYSCONF_TEMPLATES_DIR}/supervisor/supervisor /etc/init.d/
   # Copy modified supervisor config
   cp ${SYSCONF_TEMPLATES_DIR}/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
+  # Copy modified nginx start script
+  cp ${SYSCONF_TEMPLATES_DIR}/nginx/nginx /etc/init.d/
+  # Copy modified ngnix config
+  cp ${SYSCONF_TEMPLATES_DIR}/nginx/nginx.conf /etc/nginx/nginx.conf
 }
 
 update_log_settings(){
@@ -321,6 +339,9 @@ for i in ${LOG_DIR} ${LIB_DIR} ${DATA_DIR}; do
   chmod -R 755 "$i"
 done
 
+touch ${DS_LOG_DIR}/nginx.error.log
+chown www-data:www-data ${DS_LOG_DIR}/nginx.error.log
+
 if [ ${ONLYOFFICE_DATA_CONTAINER_HOST} = "localhost" ]; then
 
   read_setting
@@ -402,4 +423,4 @@ service nginx start
 documentserver-generate-allfonts.sh ${ONLYOFFICE_DATA_CONTAINER}
 documentserver-static-gzip.sh ${ONLYOFFICE_DATA_CONTAINER}
 
-tail -f /var/log/onlyoffice/**/*.log
+tail -f /var/log/${COMPANY_NAME}/**/*.log