From d9999184a4053caca520e7ae5d0cebb2adc88cdb Mon Sep 17 00:00:00 2001 From: Alexandru Epure Date: Mon, 21 May 2018 15:40:54 +0300 Subject: [PATCH] REPO-3275: Secure tomcat in Alfresco Content Services docker images. Make alfresco and ROOT directories and it's content read-only --- docker-alfresco/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-alfresco/Dockerfile b/docker-alfresco/Dockerfile index 89c8eea9b..96c3dd451 100644 --- a/docker-alfresco/Dockerfile +++ b/docker-alfresco/Dockerfile @@ -96,8 +96,8 @@ RUN java -jar /usr/local/tomcat/alfresco-mmt/alfresco-mmt*.jar install \ # Docker CMD from parent image starts the server -# Unpack ROOT.war -RUN mkdir /usr/local/tomcat/webapps/ROOT && cd /usr/local/tomcat/webapps/ROOT && jar -xvf /usr/local/tomcat/webapps/ROOT.war && rm -f /usr/local/tomcat/webapps/ROOT.war && \ +# Unpack ROOT.war and make alfresco and ROOT read-only. +RUN mkdir /usr/local/tomcat/webapps/ROOT && cd /usr/local/tomcat/webapps/ROOT && jar -xvf /usr/local/tomcat/webapps/ROOT.war && rm -f /usr/local/tomcat/webapps/ROOT.war && chmod -R =r /usr/local/tomcat/webapps/ROOT && chmod -R =r /usr/local/tomcat/webapps/alfresco && \ # Add catalina.policy to ROOT.war and alfresco.war # Grant all security permissions to alfresco webapp because of numerous permissions required in order to work properly. # Grant only deployXmlPermission to ROOT webapp.