From 794f75f22c35e991779ac5cb23f5d7d65de2a5a9 Mon Sep 17 00:00:00 2001
From: Jaime Soriano Pastor <jaime.soriano@elastic.co>
Date: Sun, 31 May 2020 16:56:46 +0200
Subject: [PATCH] Revert "Allow the Docker image to be run with a random user
 id (#12905)"

This reverts commits 9dbdc1579f350d3beaff156b78a365e3a200e2cd and 3eac5f7b69a5627dfd9e241c1916988c1c602760.
---
 CHANGELOG.next.asciidoc                              |  1 -
 dev-tools/packaging/package_test.go                  |  9 ++-------
 dev-tools/packaging/templates/docker/Dockerfile.tmpl | 10 +++++-----
 3 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index d95223354874..da165eb4d6d7 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -258,7 +258,6 @@ field. You can revert this change by configuring tags for the module and omittin
 - When using the `decode_json_fields` processor, decoded fields are now deep-merged into existing event. {pull}17958[17958]
 - Add backoff configuration options for the Kafka output. {issue}16777[16777] {pull}17808[17808]
 - Add TLS support to Kerberos authentication in Elasticsearch. {pull}18607[18607]
-- Change ownership of files in docker images so they can be used in secured environments. {pull}12905[12905]
 
 *Auditbeat*
 
diff --git a/dev-tools/packaging/package_test.go b/dev-tools/packaging/package_test.go
index 9e5c8f4e597a..96173cde880c 100644
--- a/dev-tools/packaging/package_test.go
+++ b/dev-tools/packaging/package_test.go
@@ -186,13 +186,8 @@ func checkDocker(t *testing.T, file string) {
 	checkDockerEntryPoint(t, p, info)
 	checkDockerLabels(t, p, info, file)
 	checkDockerUser(t, p, info, *rootUserContainer)
-
-	// The configuration file in the Docker image is expected to be readable and writable by any user who belongs to
-	// the root group. This is done in order to allow the docker image to run on secured Kubernetes environment where
-	// the user ID used to run a container can't be known in advance.
-	checkConfigPermissionsWithMode(t, p, os.FileMode(0660))
-	checkManifestPermissionsWithMode(t, p, os.FileMode(0660))
-
+	checkConfigPermissionsWithMode(t, p, os.FileMode(0640))
+	checkManifestPermissionsWithMode(t, p, os.FileMode(0640))
 	checkModulesPresent(t, "", p)
 	checkModulesDPresent(t, "", p)
 }
diff --git a/dev-tools/packaging/templates/docker/Dockerfile.tmpl b/dev-tools/packaging/templates/docker/Dockerfile.tmpl
index 0d6cfa90b4c4..1123bb14f7be 100644
--- a/dev-tools/packaging/templates/docker/Dockerfile.tmpl
+++ b/dev-tools/packaging/templates/docker/Dockerfile.tmpl
@@ -30,10 +30,10 @@ RUN chmod 755 /usr/local/bin/docker-entrypoint
 RUN groupadd --gid 1000 {{ .BeatName }}
 
 RUN mkdir {{ $beatHome }}/data {{ $beatHome }}/logs && \
-    chown -R root:root {{ $beatHome }} && \
-    find {{ $beatHome }} -type d -exec chmod 0770 {} \; && \
-    find {{ $beatHome }} -type f -exec chmod 0660 {} \; && \
-    chmod 0770 {{ $beatBinary }} && \
+    chown -R root:{{ .BeatName }} {{ $beatHome }} && \
+    find {{ $beatHome }} -type d -exec chmod 0750 {} \; && \
+    find {{ $beatHome }} -type f -exec chmod 0640 {} \; && \
+    chmod 0750 {{ $beatBinary }} && \
 {{- if .linux_capabilities }}
     setcap {{ .linux_capabilities }} {{ $beatBinary }} && \
 {{- end }}
@@ -43,7 +43,7 @@ RUN mkdir {{ $beatHome }}/data {{ $beatHome }}/logs && \
     chmod 0770 {{ $beatHome }}/data {{ $beatHome }}/logs
 
 {{- if ne .user "root" }}
-RUN useradd -M --uid 1000 --gid 1000 --groups 0 --home {{ $beatHome }} {{ .user }}
+RUN useradd -M --uid 1000 --gid 1000 --home {{ $beatHome }} {{ .user }}
 {{- end }}
 USER {{ .user }}