Merge branch 'feature/PB-47168_Test-non-root-docker-for-log-dir-perm-issue-with-uni-ljubljana' into 'master'

PB-47168 add log permissions to entrypoint scripts

See merge request passbolt/passbolt_docker!244

Author: dlen

debian/Dockerfile.openshift

@@ -118,8 +118,8 @@ RUN chmod 0644 /etc/supervisor/conf.d/* \
   && chmod 0755 /usr/bin/wait-for.sh
 
 # Changes ownership of some files for Openshift compatibility  
-RUN chgrp -R 0   /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx && \
-  chmod -R g=u /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx && \
+RUN chgrp -R 0   /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx /var/log/passbolt && \
+  chmod -R g=u /var/lib/passbolt /etc/passbolt /etc/supervisor /etc/environment /var/log/supervisor /var/log/nginx /var/log/passbolt && \
   chgrp 0 /var/run  && \ 
   chmod g=u /var/run && \ 
   mkdir /var/run/php && \

debian/Dockerfile.rootless

@@ -100,6 +100,8 @@ RUN sed -i 's,listen 80;,listen 8080;,' /etc/nginx/sites-enabled/nginx-passbolt.
   && ln -sf /dev/stdout /var/log/nginx/passbolt-access.log \
   && ln -sf /dev/stderr /var/log/nginx/passbolt-error.log \
   && chown -R www-data:0 /var/log/supervisor \
+  && chown -R www-data:0 /var/log/passbolt \
+  && chmod -R g+w /var/log/passbolt \
   && touch /var/www/.profile \
   && chown www-data:www-data /var/www/.profile \
   && sed -i 's,www-data\s,,' /etc/cron.d/$PASSBOLT_PKG \

spec/docker_image/image_spec.rb

@@ -194,6 +194,34 @@
     end
   end
 
+  describe '/var/log/passbolt' do
+    it 'exists and is a directory' do
+      expect(file('/var/log/passbolt')).to exist
+      expect(file('/var/log/passbolt')).to be_a_directory
+    end
+
+    it 'has the correct ownership' do
+      expect(file('/var/log/passbolt')).to be_owned_by(passbolt_owner)
+      if ENV['ROOTLESS'] == 'true'
+        expect(file('/var/log/passbolt')).to be_grouped_into('0')
+      else
+        expect(file('/var/log/passbolt')).to be_grouped_into($config_group)
+      end
+    end
+
+    it 'is writable by the owner' do
+      expect(file('/var/log/passbolt')).to be_writable.by('owner')
+    end
+
+    it 'is writable by the group' do
+      if ENV['ROOTLESS'] == 'true'
+        expect(file('/var/log/passbolt')).to be_writable.by('group')
+      else
+        skip 'Group writability only required for rootless/openshift images'
+      end
+    end
+  end
+
   describe '/etc/environment' do
     it 'exists and has the correct permissions' do
       expect(file('/etc/environment')).to exist