fix (JupyterHub): removed root permissions for chsh

ertis-research · Jun 27, 2024 · 1755831 · 1755831
1 parent 1770169
commit 1755831
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/jupyterhub/base-cuda12.2-cudnn8-py3.11/Dockerfile b/jupyterhub/base-cuda12.2-cudnn8-py3.11/Dockerfile
@@ -33,6 +33,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     atop \
     jq \
     zsh \
+    sed \
     && \    
     apt-get clean && rm -rf /var/lib/apt/lists/* && \
     echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && \
@@ -93,6 +94,10 @@ RUN echo "auth requisite pam_deny.so" >> /etc/pam.d/su && \
 
 # RUN chsh -s /bin/zsh
 
+RUN sed -i 's/auth\s*sufficient\s*pam_shells.so/auth\s*required\s*pam_shells.so/g' /etc/pam.d/chsh
+# Additional line to modify pam_rootok.so (usually not needed)
+# RUN sed -i 's/auth\s*sufficient\s*pam_rootok.so/auth\s*required\s*pam_rootok.so/g' /etc/pam.d/chsh
+
 USER ${NB_UID}
 
 RUN chsh -s /bin/zsh

diff --git a/jupyterhub/base-py3.11/Dockerfile b/jupyterhub/base-py3.11/Dockerfile
@@ -33,6 +33,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     atop \
     jq \
     zsh \
+    sed \
     && \    
     apt-get clean && rm -rf /var/lib/apt/lists/* && \
     echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && \
@@ -93,6 +94,10 @@ RUN echo "auth requisite pam_deny.so" >> /etc/pam.d/su && \
 
 # RUN chsh -s /bin/zsh
 
+RUN sed -i 's/auth\s*sufficient\s*pam_shells.so/auth\s*required\s*pam_shells.so/g' /etc/pam.d/chsh
+# Additional line to modify pam_rootok.so (usually not needed)
+# RUN sed -i 's/auth\s*sufficient\s*pam_rootok.so/auth\s*required\s*pam_rootok.so/g' /etc/pam.d/chsh
+
 USER ${NB_UID}
 
 RUN chsh -s /bin/zsh