Upgrade supervisord to 3.3.3 and fix supervisord.conf

[nikos-github]

Update supervisord to version 3.3.3 to address security vulnerability CVE-2017-11610 and fixing supervisord.conf to address the following critical warnings:

2018-01-19 06:59:08,289 CRIT Supervisor running as root (no user in config file)
2018-01-19 06:59:08,317 CRIT Server 'unix_http_server' running without any HTTP authentication checking

To test this I pulled a workspace, applied the changes, built the image, verified that version 3.3.3 of supervisord was pulled in and that it includes the fix for the security vulnerability, loaded the image and verified with the config changes that CRIT syslogs are now gone.

[jleveque]

Just to confirm: Do my clock-rollback patches still apply cleanly to v3.3.3? (https://github.com/Azure/sonic-buildimage/tree/master/src/supervisor/patch)

[nikos-github]

@jleveque Yes no issues with the patches. They both patched cleanly.

[lguohan]

I remember joe also developed the unit test for his patches, are those unit test also passing for 3.3.3?

[jleveque]

@lguohan: The supervisor build should fail if any of the unit tests do not pass. Since the check builds all succeeded, I believe all the unit tests passed.

[lguohan]

does this mean we need to type username and password for supervisorctl command line? is that necessary?

[lguohan]

from your commit message, you are trying to address http server accessing issue, so I am not sure if we need to add username/password for the supervisorctl command line as well. Since once you can get into the docker, you already have sudo privilege, adding extra user/pass protection does not seem necessary.

[nikos-github]

The username and password of supervisorctl need to be the same as those of supervisord server configuration for the port or UNIX domain socket. Given this expectation/requirement, I made the change accordingly.

[lguohan]

where does this requirement come from?

"The username and password of supervisorctl need to be the same as those of supervisord server configuration for the port or UNIX domain socket"

[nikos-github]

From supervisord's configuration file requirements (http://supervisord.org/configuration.html or https://github.com/Supervisor/supervisor/blob/master/docs/configuration.rst)

[lguohan]

ok. can you change both username and password to dummy, nobody seems to be related the nobody unix user.

[nikos-github]

You sure you want that changed to dummy? I picked nobody because it's defined as a unix user account that has no access. If some dummy goes and defines dummy, they'll get an unwanted association :-) I don't mind either way but playing it safe is a better choice.

[lguohan]

I thought this is not related to unix account at all.

[nikos-github]

It's not but not knowing what changes the future can bring, I made the choice to pick a username that can't be used to gain access to the box from a unix perspective (yes - once you're into the docker you have sudo privileges anyway). I'm fine with dummy/dummy.