Files
Josh HawkinsandGitHub 2347f954bb Container security hardening (phase 2) (#24068)
* Create frigate and go2rtc runtime users in the image

* Add single fix-ownership helper for volume permission migration

* Add init-usermod oneshot for PUID and PGID remapping

* Chown newly created runtime directories to the frigate user

* Run sentinel-guarded ownership sweep during prepare

* Add host-side volume permission migration script

* Guard log directory ownership for user-mode startup

* Fall back to plain s6-log when running without root

* Assert PUID remapping and sweep sentinel in CI smoke test

* Skip the ownership sweep in the devcontainer

* Pin FRIGATE_RUN_AS_ROOT in ownership tests

* Do not record the sweep as complete when a chown failed

* Validate PUID and PGID in the migration script

* Treat a failed ownership scan as an incomplete sweep

* Reject PUID and PGID of 0 during remapping

* Handle symlinks, dry runs, and sentinel write failures in the sweep

* Treat an absent sweep root as an incomplete sweep
2026-08-23 14:40:32 -06:00

160 lines
6.2 KiB
Plaintext
Executable File

#!/command/with-contenv bash
# shellcheck shell=bash
# Do preparation tasks before starting the main services
set -o errexit -o nounset -o pipefail
function migrate_addon_config_dir() {
local home_assistant_config_dir="/homeassistant"
if ! mountpoint --quiet "${home_assistant_config_dir}"; then
# Not running as a Home Assistant Add-on
return 0
fi
local config_dir="/config"
local new_config_file="${config_dir}/config.yml"
local new_config_file_yaml="${new_config_file//.yml/.yaml}"
if [[ -f "${new_config_file_yaml}" || -f "${new_config_file}" ]]; then
# Already migrated
return 0
fi
local old_config_file="${home_assistant_config_dir}/frigate.yml"
local old_config_file_yaml="${old_config_file//.yml/.yaml}"
if [[ -f "${old_config_file}" ]]; then
:
elif [[ -f "${old_config_file_yaml}" ]]; then
old_config_file="${old_config_file_yaml}"
new_config_file="${new_config_file_yaml}"
else
# Nothing to migrate
return 0
fi
unset old_config_file_yaml new_config_file_yaml
echo "[INFO] Starting migration from Home Assistant config dir to Add-on config dir..." >&2
local db_path
db_path=$(yq -r '.database.path' "${old_config_file}")
if [[ "${db_path}" == "null" ]]; then
db_path="${config_dir}/frigate.db"
fi
if [[ "${db_path}" == "${config_dir}/"* ]]; then
# replace /config/ prefix with /homeassistant/
local old_db_path="${home_assistant_config_dir}/${db_path:8}"
if [[ -f "${old_db_path}" ]]; then
local new_db_dir
new_db_dir="$(dirname "${db_path}")"
echo "[INFO] Migrating database from '${old_db_path}' to '${new_db_dir}' dir..." >&2
mkdir -vp "${new_db_dir}"
mv -vf "${old_db_path}" "${new_db_dir}"
local db_file
for db_file in "${old_db_path}"-shm "${old_db_path}"-wal; do
if [[ -f "${db_file}" ]]; then
mv -vf "${db_file}" "${new_db_dir}"
fi
done
unset db_file
fi
fi
local config_entry
for config_entry in .model.path .model.labelmap_path .ffmpeg.path .mqtt.tls_ca_certs .mqtt.tls_client_cert .mqtt.tls_client_key; do
local config_entry_path
config_entry_path=$(yq -r "${config_entry}" "${old_config_file}")
if [[ "${config_entry_path}" == "${config_dir}/"* ]]; then
# replace /config/ prefix with /homeassistant/
local old_config_entry_path="${home_assistant_config_dir}/${config_entry_path:8}"
if [[ -f "${old_config_entry_path}" ]]; then
local new_config_entry_entry
new_config_entry_entry="$(dirname "${config_entry_path}")"
echo "[INFO] Migrating ${config_entry} from '${old_config_entry_path}' to '${config_entry_path}'..." >&2
mkdir -vp "${new_config_entry_entry}"
mv -vf "${old_config_entry_path}" "${config_entry_path}"
fi
fi
done
local old_model_cache_path="${home_assistant_config_dir}/model_cache"
if [[ -d "${old_model_cache_path}" ]]; then
echo "[INFO] Migrating '${old_model_cache_path}' to '${config_dir}'..." >&2
mv -f "${old_model_cache_path}" "${config_dir}"
fi
echo "[INFO] Migrating other files from '${home_assistant_config_dir}' to '${config_dir}'..." >&2
local file
for file in .exports .jwt_secret .timeline .vacuum go2rtc; do
file="${home_assistant_config_dir}/${file}"
if [[ -f "${file}" ]]; then
mv -vf "${file}" "${config_dir}"
fi
done
echo "[INFO] Migrating config file from '${old_config_file}' to '${new_config_file}'..." >&2
mv -vf "${old_config_file}" "${new_config_file}"
echo "[INFO] Migration from Home Assistant config dir to Add-on config dir completed." >&2
}
function migrate_db_from_media_to_config() {
# Find config file in yml or yaml, but prefer yml
local config_file="${CONFIG_FILE:-"/config/config.yml"}"
local config_file_yaml="${config_file//.yml/.yaml}"
if [[ -f "${config_file}" ]]; then
:
elif [[ -f "${config_file_yaml}" ]]; then
config_file="${config_file_yaml}"
else
# Frigate will create the config file on startup
return 0
fi
unset config_file_yaml
local user_db_path
user_db_path=$(yq -r '.database.path' "${config_file}")
if [[ "${user_db_path}" == "null" ]]; then
local old_db_path="/media/frigate/frigate.db"
local new_db_dir="/config"
if [[ -f "${old_db_path}" ]]; then
echo "[INFO] Migrating database from '${old_db_path}' to '${new_db_dir}' dir..." >&2
if mountpoint --quiet "${new_db_dir}"; then
# /config is a mount point, move the db
mv -vf "${old_db_path}" "${new_db_dir}"
local db_file
for db_file in "${old_db_path}"-shm "${old_db_path}"-wal; do
if [[ -f "${db_file}" ]]; then
mv -vf "${db_file}" "${new_db_dir}"
fi
done
unset db_file
else
echo "[ERROR] Trying to migrate the database path from '${old_db_path}' to '${new_db_dir}' dir, but '${new_db_dir}' is not a mountpoint, please mount the '${new_db_dir}' dir" >&2
return 1
fi
fi
fi
}
# remove leftover from last run, not normally needed, but just in case
# used by the docker healthcheck
rm -f /dev/shm/.frigate-is-stopping
migrate_addon_config_dir
migrate_db_from_media_to_config
# Align volume ownership with the runtime user (one sweep per PUID/schema
# change, guarded by the sentinel; see fix-ownership). The escape hatch
# deletes the sentinel instead: ownership is never mutated while it is on,
# so the next non-root boot must re-sweep whatever root created meanwhile.
if [[ "$(id -u)" -eq 0 ]]; then
if [[ "${FRIGATE_RUN_AS_ROOT:-false}" == "true" ]]; then
rm -f /config/.permissions_version
else
/usr/local/bin/fix-ownership --sentinel /config/.permissions_version \
"${PUID:-1000}" "${PGID:-1000}" /config /media/frigate
fi
fi