Назад | Перейти на главную страницу

Невозможно получить доступ к файлам в докере как пользователь без полномочий root 777 permissions + facls

У меня есть докер-контейнер с веб-приложением. Apache не может читать в папку журнала. У пользователя apache есть определенный rwx в папке facl. Я установил 0777 в папке рекурсивно внутри и вне контейнера. Внутри контейнера только root может читать файлы. Вне каждый может. Внутри контейнера ls от пользователя apache выглядит так:

-????????? ? ? ? ?            ? access_log
-????????? ? ? ? ?            ? app.log
-????????? ? ? ? ?            ? error_log

Я запустил strace, который не дал ничего полезного. Вот пример open, access, lstat для полноты.

[www-data@a377ecbb9c76 www]$ strace -e open,access,lstat ls -l /var/www/logs/
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libselinux.so.1", O_RDONLY) = 3
open("/lib64/librt.so.1", O_RDONLY)     = 3
open("/lib64/libcap.so.2", O_RDONLY)    = 3
open("/lib64/libacl.so.1", O_RDONLY)    = 3
open("/lib64/libc.so.6", O_RDONLY)      = 3
open("/lib64/libdl.so.2", O_RDONLY)     = 3
open("/lib64/libpthread.so.0", O_RDONLY) = 3
open("/lib64/libattr.so.1", O_RDONLY)   = 3
open("/proc/filesystems", O_RDONLY)     = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("/usr/share/locale/locale.alias", O_RDONLY) = 3
open("/usr/share/locale/en_US.UTF-8/LC_TIME/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_TIME/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_TIME/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_TIME/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_TIME/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_TIME/coreutils.mo", O_RDONLY) = 3
open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 3
lstat("/var/www/logs/", {st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0
lstat("/var/www/logs/", {st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib64/libnss_files.so.2", O_RDONLY) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/group", O_RDONLY|O_CLOEXEC)  = 3
open("/var/www/logs/", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
lstat("/var/www/logs/error_log", 0xf17800) = -1 EACCES (Permission denied)
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/coreutils.mo", O_RDONLY) = 4
ls: cannot access /var/www/logs/error_logopen("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
: Permission denied
lstat("/var/www/logs/app.log", 0xf178c0) = -1 EACCES (Permission denied)
ls: cannot access /var/www/logs/app.log: Permission denied
lstat("/var/www/logs/access_log", 0xf17980) = -1 EACCES (Permission denied)
ls: cannot access /var/www/logs/access_log: Permission denied
total 0
open("/etc/localtime", O_RDONLY)        = 3
-????????? ? ? ? ?            ? access_log
-????????? ? ? ? ?            ? app.log
-????????? ? ? ? ?            ? error_log
+++ exited with 1 +++

я получил ключ к ответу на это на stackoverflow.

Мои контейнеры докеров не настроены для поддержки ACL, и наличие в них ACL вызывало проблему. Команда setfacl -Rb logs/ снаружи контейнер закрепил его.