Update Dockerfile (SeleniumHQ#1773)

* Tuning chmod permissions

* Kick CI

* More tuning

* Tuning a bit more

* Update Dockerfile

Change rights to 775

* Update Dockerfile

Change rights

* Tuning chmod permissions

* More tuning

* Tuning a bit more

* Change group for some directories

Change group of directories "/opt/selenium ${HOME} /opt/selenium/assets /var/run/supervisor /var/log/supervisor" to group seluser

* Usage of ACL

Usage of ACL to stay with root's rights for user and group but add some rights to user seluser with ACL

* Install ACL package

* typo in command setfacl

* change stefacl location on script

* Change setfacl location once again

* add acl to /opt

* Update Dockerfile

Adding sudo to avoid "permission denied" messages

---------

Co-authored-by: Diego Molina <[email protected]>
Co-authored-by: Diego Molina <[email protected]>

Author: StevenBOULLE

Base/Dockerfile

@@ -18,6 +18,7 @@ ENV DEBIAN_FRONTEND=noninteractive \
 #========================
 RUN apt-get -qqy update \
   && apt-get -qqy --no-install-recommends install \
+    acl \
     bzip2 \
     ca-certificates \
     openjdk-11-jre-headless \
@@ -76,7 +77,8 @@ RUN  mkdir -p /opt/selenium /opt/selenium/assets /var/run/supervisor /var/log/su
   && wget --no-verbose https://repo1.maven.org/maven2/org/seleniumhq/selenium/selenium-http-jdk-client/4.8.1/selenium-http-jdk-client-4.8.1.jar \
     -O /opt/selenium/selenium-http-jdk-client.jar \
   && chgrp -R 0 /opt/selenium ${HOME} /opt/selenium/assets /var/run/supervisor /var/log/supervisor \
-  && chmod -R g=u /opt/selenium ${HOME} /opt/selenium/assets /var/run/supervisor /var/log/supervisor
+  && chmod -R g=u /opt/selenium ${HOME} /opt/selenium/assets /var/run/supervisor /var/log/supervisor \
+  && setfacl -Rm u:seluser:rwx /opt /opt/selenium ${HOME} /opt/selenium/assets /var/run/supervisor /var/log/supervisor
 
 #=====
 # Download observability related jaegar jars and make them available in a separate directory
@@ -85,11 +87,11 @@ RUN  mkdir -p /opt/selenium /opt/selenium/assets /var/run/supervisor /var/log/su
 RUN curl -fLo /tmp/cs https://github.com/coursier/launchers/raw/master/coursier \
   && chmod +x /tmp/cs \
   && mkdir -p /external_jars \
-  && chmod -R 777 /external_jars
+  && chmod -R 775 /external_jars
 
 RUN /tmp/cs fetch --classpath --cache /external_jars io.opentelemetry:opentelemetry-exporter-jaeger:1.22.0 io.grpc:grpc-netty:1.52.1 > /external_jars/.classpath.txt
 
-RUN chmod 777 /external_jars/.classpath.txt
+RUN chmod 664 /external_jars/.classpath.txt
 
 #===================================================
 # Run the following commands as non-privileged user

NodeBase/Dockerfile

@@ -141,7 +141,7 @@ RUN mkdir -p ${HOME}/.vnc \
 #==========
 # Relaxing permissions for OpenShift and other non-sudo environments
 #==========
-RUN sudo chmod -R 777 ${HOME} \
+RUN sudo chmod -R 775 ${HOME} \
   && sudo chgrp -R 0 ${HOME} \
   && sudo chmod -R g=u ${HOME}
 

NodeChrome/Dockerfile

@@ -52,14 +52,14 @@ RUN if [ -z "$CHROME_DRIVER_VERSION" ]; \
   && echo "Using chromedriver version: "$CHROME_DRIVER_VERSION \
   && wget --no-verbose -O /tmp/chromedriver_linux64.zip https://chromedriver.storage.googleapis.com/$CHROME_DRIVER_VERSION/chromedriver_linux64.zip \
   && rm -rf /opt/selenium/chromedriver \
-  && unzip /tmp/chromedriver_linux64.zip -d /opt/selenium \
+  && sudo unzip /tmp/chromedriver_linux64.zip -d /opt/selenium \
   && rm /tmp/chromedriver_linux64.zip \
-  && mv /opt/selenium/chromedriver /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION \
-  && chmod 755 /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION \
+  && sudo mv /opt/selenium/chromedriver /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION \
+  && sudo chmod 755 /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION \
   && sudo ln -fs /opt/selenium/chromedriver-$CHROME_DRIVER_VERSION /usr/bin/chromedriver
 
 
 #============================================
 # Dumping Browser name and version for config
 #============================================
-RUN echo "chrome" > /opt/selenium/browser_name
+RUN echo "chrome" > /opt/selenium/browser_name