From ffcb76f73fbff837d6feff79b114bb77724ad04b Mon Sep 17 00:00:00 2001 From: Geoff Bourne Date: Sat, 11 Dec 2021 16:51:01 -0600 Subject: [PATCH 1/3] build: auto-create github release when docker-versions-create with tag (#1188) --- docker-versions-create.sh | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/docker-versions-create.sh b/docker-versions-create.sh index 5a2f8226..a5c07e7e 100755 --- a/docker-versions-create.sh +++ b/docker-versions-create.sh @@ -130,3 +130,28 @@ EOL fi done + +if [[ $tag ]]; then + if [ -f "$HOME/.github.env" ]; then + source "$HOME/.github.env" + if [[ $GITHUB_TOKEN ]] + then + auth=(-u ":$GITHUB_TOKEN") + base=https://api.github.com + : "${owner:=itzg}" + : "${repo:=docker-minecraft-server}" + read -r -d '' releaseBody << EOF + { + "tag_name": "$tag", + "name": "$tag", + "generate_release_notes": true + } +EOF + if ! curl "${auth[@]}" -H "Accept: application/vnd.github.v3+json" \ + "${base}/repos/${owner}/${repo}/releases" -d "$releaseBody"; then + echo "ERROR failed to create github release $tag" + exit 1 + fi + fi + fi +fi \ No newline at end of file From c4aa10504219f7bfcb019cfc136643ecfa5da5f6 Mon Sep 17 00:00:00 2001 From: Brett Randall Date: Mon, 13 Dec 2021 01:10:18 +1100 Subject: [PATCH 2/3] Added --chmod to all COPY instructions in Dockerfile (#1184) --- Dockerfile | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/Dockerfile b/Dockerfile index a57873a2..b391f01f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -26,7 +26,7 @@ RUN apt-get update \ RUN addgroup --gid 1000 minecraft \ && adduser --system --shell /bin/false --uid 1000 --ingroup minecraft --home /data minecraft -COPY files/sudoers* /etc/sudoers.d +COPY --chmod=644 files/sudoers* /etc/sudoers.d EXPOSE 25565 25575 @@ -78,15 +78,14 @@ ENV UID=1000 GID=1000 \ ENABLE_AUTOPAUSE=false AUTOPAUSE_TIMEOUT_EST=3600 AUTOPAUSE_TIMEOUT_KN=120 AUTOPAUSE_TIMEOUT_INIT=600 \ AUTOPAUSE_PERIOD=10 AUTOPAUSE_KNOCK_INTERFACE=eth0 -COPY scripts/start* / -COPY bin/ /usr/local/bin/ -COPY bin/mc-health /health.sh -COPY files/server.properties /tmp/server.properties -COPY files/log4j2.xml /tmp/log4j2.xml -COPY files/autopause /autopause +COPY --chmod=755 scripts/start* / +COPY --chmod=755 bin/ /usr/local/bin/ +COPY --chmod=755 bin/mc-health /health.sh +COPY --chmod=644 files/server.properties /tmp/server.properties +COPY --chmod=644 files/log4j2.xml /tmp/log4j2.xml +COPY --chmod=755 files/autopause /autopause -RUN dos2unix /start* && chmod +x /start* \ - && dos2unix /autopause/* && chmod +x /autopause/*.sh +RUN dos2unix /start* /autopause/* ENTRYPOINT [ "/start" ] HEALTHCHECK --start-period=1m CMD mc-health From eccc989887bc4757d9c3f7083230609bbf7453df Mon Sep 17 00:00:00 2001 From: Levy Ehrstein Date: Sun, 12 Dec 2021 15:19:16 +0100 Subject: [PATCH 3/3] secruity: Fix CVE-2021-44228 mitigation (#1190) --- scripts/start-finalExec | 51 +++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/scripts/start-finalExec b/scripts/start-finalExec index e34222c6..8e684d97 100755 --- a/scripts/start-finalExec +++ b/scripts/start-finalExec @@ -107,7 +107,36 @@ if [ -n "$ICON" ]; then fi fi +canUseRollingLogs=true + +patchLog4jConfig() { + file=${1?} + url=${2?} + if ! get -o "$file" "$url"; then + log "ERROR: failed to download corrected log4j config" + exit 1 + fi + JVM_OPTS="-Dlog4j.configurationFile=${file} ${JVM_OPTS}" + canUseRollingLogs=false +} + +# Patch Log4j remote code execution vulnerability +# See https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition +if versionLessThan 1.7; then + : # No patch required here. +elif isFamily VANILLA && versionLessThan 1.12; then + patchLog4jConfig log4j2_17-111.xml https://launcher.mojang.com/v1/objects/dd2b723346a8dcd48e7f4d245f6bf09e98db9696/log4j2_17-111.xml +elif isFamily VANILLA && versionLessThan 1.17; then + patchLog4jConfig log4j2_112-116.xml https://launcher.mojang.com/v1/objects/02937d122c86ce73319ef9975b58896fc1b491d1/log4j2_112-116.xml +elif versionLessThan 1.18.1; then + JVM_OPTS="-Dlog4j2.formatMsgNoLookups=true ${JVM_OPTS}" +fi + if isTrue ${ENABLE_ROLLING_LOGS:-false}; then + if ! ${canUseRollingLogs}; then + log "ERROR: Using rolling logs is currently not possible in the selected version due to CVE-2021-44228" + exit 1 + fi # Set up log configuration LOGFILE="/data/log4j2.xml" if [ ! -e "$LOGFILE" ]; then @@ -150,28 +179,6 @@ if [ -n "$JVM_DD_OPTS" ]; then done fi -patchLog4jConfig() { - file=${1?} - url=${2?} - if ! get -o "$file" "$url"; then - log "ERROR: failed to download corrected log4j config" - exit 1 - fi - JVM_OPTS="-Dlog4j.configurationFile=${file} ${JVM_OPTS}" -} - -# Patch Log4j remote code execution vulnerability -# See https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition -if versionLessThan 1.7; then - : # No patch required here. -elif isFamily VANILLA && versionLessThan 1.12; then - patchLog4jConfig log4j2_17-111.xml https://launcher.mojang.com/v1/objects/dd2b723346a8dcd48e7f4d245f6bf09e98db9696/log4j2_17-111.xml -elif isFamily VANILLA && versionLessThan 1.17; then - patchLog4jConfig log4j2_112-116.xml https://launcher.mojang.com/v1/objects/02937d122c86ce73319ef9975b58896fc1b491d1/log4j2_112-116.xml -elif versionLessThan 1.18.1; then - JVM_OPTS="-Dlog4j2.formatMsgNoLookups=true ${JVM_OPTS}" -fi - if isTrue ${ENABLE_JMX}; then : ${JMX_PORT:=7091} JVM_OPTS="${JVM_OPTS}