Run the server as an unprivileged user

1 files changed, 7 insertions, 4 deletions

diff --git a/contrib/docker/start.py b/contrib/docker/start.py
index 7057f85f61..8bc72bf428 100755
--- a/contrib/docker/start.py
+++ b/contrib/docker/start.py
@@ -9,14 +9,16 @@ convert = lambda src, dst, environ: open(dst, "w").write(jinja2.Template(open(sr
 mode = sys.argv[1] if len(sys.argv) > 1 else None
 environ = os.environ.copy()
 
+# Check mandatory parameters and build the base start arguments
 if "SYNAPSE_SERVER_NAME" not in environ:
     print("Environment variable SYNAPSE_SERVER_NAME is mandatory, exiting.")
     sys.exit(2)
 
+permissions = "{}:{}".format(environ.get("UID", 991), environ.get("GID", 991))
 args = ["python", "-m", "synapse.app.homeserver",
-        "--server-name", os.environ.get("SYNAPSE_SERVER_NAME"),
-        "--report-stats", os.environ.get("SYNAPSE_REPORT_STATS", "no"),
-        "--config-path", os.environ.get("SYNAPSE_CONFIG_PATH", "/compiled/homeserver.yaml")]
+        "--server-name", environ.get("SYNAPSE_SERVER_NAME"),
+        "--report-stats", environ.get("SYNAPSE_REPORT_STATS", "no"),
+        "--config-path", environ.get("SYNAPSE_CONFIG_PATH", "/compiled/homeserver.yaml")]
 
 # Generate any missing shared secret
 for secret in ("SYNAPSE_REGISTRATION_SHARED_SECRET", "SYNAPSE_MACAROON_SECRET_KEY"):
@@ -35,4 +37,5 @@ if mode == "generate":
 # In normal mode, generate missing keys if any, then run synapse
 else:
     subprocess.check_output(args + ["--generate-keys"])
-    os.execv("/usr/local/bin/python", args)
+    subprocess.check_output(["chown", "-R", permissions, "/data"])
+    os.execv("/sbin/su-exec", ["su-exec", permissions] + args)