assuming a readonly root, if we gen certs, don't overwrite the originals

[caolanm]

Change-Id: Id1077ff63203f74f4802af087558a6ae652fbcf1

• Resolves: #
• Target version: master

Summary

TODO

• ...

Checklist

• I have run make prettier-write and formatted the code.
• All commits have Change-Id
• I have run tests with make check
• I have issued make run and manually verified that everything looks okay
• Documentation (manuals or wiki) has been updated or is not required

[caolanm]

If we do this, then we can get a step closer to a running under docker --read-only

[timar]

If we do this, then we can get a step closer to a running under docker --read-only

Is this because /tmp is in memory so it does not count?
But I still don't understand. With your patch we do not overwrite the cert files in /etc/coolwsd, but we effectively override them, because command line settings take precedence over /etc/coolwsd/coolwsd.xml setting. Maybe this scenario makes no sense (i.e. when we have something in /etc/coolwsd and we generate cert. So maybe it's OK...

As a side note, I always wanted to get rid of this startup shell script. (I expect next time we will be asked to start coolwsd directly, remove shell as an attack vector etc.)

[caolanm]

Is this because /tmp is in memory so it does not count?

With docker --read-only (from man docker-run) apparently you get an implied additional option that is "When running --read-only containers, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp. The default is true". So /tmp is still writable unless there is an additional --read-only-tmpfs=false at which point "In this mode writable directories need to be added via external volumes or mounts". The report, so far, has been a permission failure on the cp to the final dest, not the initial generation in /tmp, so I think its safe to assume a writeable /tmp (and /var/tmp), but not a writeable /etc

With your patch we do not overwrite the cert files in /etc/coolwsd, but we effectively override them, because command line settings take precedence over /etc/coolwsd/coolwsd.xml setting.

That's my thinking here.