Removed root group for zabbix user in all images. Using nmap without sudo permissions

This commit is contained in:
Alexey Pustovalov
2024-01-19 00:19:02 +09:00
parent 8d7020e327
commit 6de76b2e8c
61 changed files with 97 additions and 119 deletions

View File

@ -13,7 +13,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git
ENV TERM=xterm \
ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \
MIBDIRS=/usr/share/snmp/mibs:/var/lib/zabbix/mibs MIBS=+ALL
MIBDIRS=/usr/share/snmp/mibs:/var/lib/zabbix/mibs MIBS=+ALL \
NMAP_PRIVILEGED=""
LABEL org.opencontainers.image.authors="Alexey Pustovalov <alexey.pustovalov@zabbix.com>" \
org.opencontainers.image.description="Zabbix proxy with SQLite3 database support" \
@ -36,7 +37,6 @@ RUN set -eux && \
REPOLIST="baseos,appstream,epel" && \
INSTALL_PKGS="libevent \
tini \
sudo \
traceroute \
nmap \
libssh \
@ -67,12 +67,12 @@ RUN set -eux && \
--system \
--comment "Zabbix monitoring system" \
-g zabbix \
-G root \
--uid 1997 \
--shell /sbin/nologin \
--home-dir /var/lib/zabbix/ \
zabbix && \
echo "zabbix ALL=(root) NOPASSWD: /usr/bin/nmap" >> /etc/sudoers.d/zabbix && \
chgrp zabbix /usr/bin/nmap && \
setcap cap_net_raw+eip /usr/bin/nmap && \
mkdir -p /etc/zabbix && \
mkdir -p /var/lib/zabbix && \
mkdir -p /var/lib/zabbix/db_data && \