mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-01-09 19:24:45 +08:00
caca3bf427
* Enable FIPS 140-3 compliant crypto by default Addresses #6889 - Enable GOEXPERIMENT=systemcrypto by default in all Makefiles - Enable GOEXPERIMENT=systemcrypto by default in all Dockerfiles - Go 1.24+ has native FIPS 140-3 support via this setting - Users can disable by setting GOEXPERIMENT= (empty) Algorithms used (all FIPS approved): - AES-256-GCM for data encryption - AES-256-CTR for SSE-C - HMAC-SHA256 for S3 signatures - TLS 1.2/1.3 for transport encryption * Fix: Remove invalid GOEXPERIMENT=systemcrypto Go 1.24 uses GODEBUG=fips140=on at runtime, not GOEXPERIMENT at build time. - Remove GOEXPERIMENT=systemcrypto from all Makefiles - Remove GOEXPERIMENT=systemcrypto from all Dockerfiles FIPS 140-3 mode can be enabled at runtime: GODEBUG=fips140=on ./weed server ... * Add FIPS 140-3 support enabled by default Addresses #6889 - FIPS 140-3 mode is ON by default in Docker containers - Sets GODEBUG=fips140=on via entrypoint.sh - To disable: docker run -e GODEBUG=fips140=off ...
102 lines
2.6 KiB
Bash
Executable File
102 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# Enable FIPS 140-3 mode by default (Go 1.24+)
|
|
# To disable: docker run -e GODEBUG=fips140=off ...
|
|
export GODEBUG="${GODEBUG:+$GODEBUG,}fips140=on"
|
|
|
|
# Fix permissions for mounted volumes
|
|
# If /data is mounted from host, it might have different ownership
|
|
# Fix this by ensuring seaweed user owns the directory
|
|
if [ "$(id -u)" = "0" ]; then
|
|
# Running as root, check and fix permissions if needed
|
|
SEAWEED_UID=$(id -u seaweed)
|
|
SEAWEED_GID=$(id -g seaweed)
|
|
|
|
# Verify seaweed user and group exist
|
|
if [ -z "$SEAWEED_UID" ] || [ -z "$SEAWEED_GID" ]; then
|
|
echo "Error: 'seaweed' user or group not found. Cannot fix permissions." >&2
|
|
exit 1
|
|
fi
|
|
|
|
DATA_UID=$(stat -c '%u' /data 2>/dev/null)
|
|
DATA_GID=$(stat -c '%g' /data 2>/dev/null)
|
|
|
|
# Only run chown -R if ownership doesn't match (much faster for subsequent starts)
|
|
echo "Fixing /data ownership for seaweed user (uid=$SEAWEED_UID, gid=$SEAWEED_GID)"
|
|
if ! chown -R seaweed:seaweed /data; then
|
|
echo "Warning: Failed to change ownership of /data. This may cause permission errors." >&2
|
|
echo "If /data is read-only or has mount issues, the application may fail to start." >&2
|
|
fi
|
|
|
|
# Use su-exec to drop privileges and run as seaweed user
|
|
exec su-exec seaweed "$0" "$@"
|
|
fi
|
|
|
|
isArgPassed() {
|
|
arg="$1"
|
|
argWithEqualSign="$1="
|
|
shift
|
|
while [ $# -gt 0 ]; do
|
|
passedArg="$1"
|
|
shift
|
|
case $passedArg in
|
|
"$arg")
|
|
return 0
|
|
;;
|
|
"$argWithEqualSign"*)
|
|
return 0
|
|
;;
|
|
esac
|
|
done
|
|
return 1
|
|
}
|
|
|
|
case "$1" in
|
|
|
|
'master')
|
|
ARGS="-mdir=/data -volumePreallocate -volumeSizeLimitMB=1024"
|
|
shift
|
|
exec /usr/bin/weed -logtostderr=true master $ARGS $@
|
|
;;
|
|
|
|
'volume')
|
|
ARGS="-dir=/data -max=0"
|
|
if isArgPassed "-max" "$@"; then
|
|
ARGS="-dir=/data"
|
|
fi
|
|
shift
|
|
exec /usr/bin/weed -logtostderr=true volume $ARGS $@
|
|
;;
|
|
|
|
'server')
|
|
ARGS="-dir=/data -volume.max=0 -master.volumePreallocate -master.volumeSizeLimitMB=1024"
|
|
if isArgPassed "-volume.max" "$@"; then
|
|
ARGS="-dir=/data -master.volumePreallocate -master.volumeSizeLimitMB=1024"
|
|
fi
|
|
shift
|
|
exec /usr/bin/weed -logtostderr=true server $ARGS $@
|
|
;;
|
|
|
|
'filer')
|
|
ARGS=""
|
|
shift
|
|
exec /usr/bin/weed -logtostderr=true filer $ARGS $@
|
|
;;
|
|
|
|
's3')
|
|
ARGS="-domainName=$S3_DOMAIN_NAME -key.file=$S3_KEY_FILE -cert.file=$S3_CERT_FILE"
|
|
shift
|
|
exec /usr/bin/weed -logtostderr=true s3 $ARGS $@
|
|
;;
|
|
|
|
'shell')
|
|
ARGS="-cluster=$SHELL_CLUSTER -filer=$SHELL_FILER -filerGroup=$SHELL_FILER_GROUP -master=$SHELL_MASTER -options=$SHELL_OPTIONS"
|
|
shift
|
|
exec echo "$@" | /usr/bin/weed -logtostderr=true shell $ARGS
|
|
;;
|
|
|
|
*)
|
|
exec /usr/bin/weed $@
|
|
;;
|
|
esac
|