Node.js needs to execute arbitrary code at runtime

Changelog.md

@@ -4,6 +4,7 @@ This file only reflects the changes that are made in the the docker image. Pleas
 
 **latest**
 - gitlab-ci: upgrade to v.7.14.2
+- Node.js needs to execute arbitrary code at runtime
 
 **7.14.1**
 - gitlab-ci: upgrade to v.7.14.1

assets/setup/install.sh

@@ -7,12 +7,15 @@ GEM_CACHE_DIR="${SETUP_DIR}/cache"
 apt-get update
 
 # install build dependencies for gem installation
-apt-get install -y gcc g++ make patch libc6-dev ruby2.1-dev \
+apt-get install -y gcc g++ make patch paxctl libc6-dev ruby2.1-dev \
   libmysqlclient-dev libpq-dev zlib1g-dev libyaml-dev libssl-dev \
   libgdbm-dev libreadline-dev libncurses5-dev libffi-dev \
   libxml2-dev libxslt-dev libcurl4-openssl-dev libicu-dev
 
-# add git user
+# https://en.wikibooks.org/wiki/Grsecurity/Application-specific_Settings#Node.js
+paxctl -Cm `which nodejs`
+
+# add gitlab_ci user
 adduser --disabled-login --gecos 'GitLab CI' ${GITLAB_CI_USER}
 
 # set PATH (fixes cron job PATH issues)
@@ -177,7 +180,7 @@ stderr_logfile=${GITLAB_CI_LOG_DIR}/supervisor/%(program_name)s.log
 EOF
 
 # purge build dependencies
-apt-get purge -y --auto-remove gcc g++ make patch libc6-dev ruby-dev \
+apt-get purge -y --auto-remove gcc g++ make patch paxctl libc6-dev ruby-dev \
   libmysqlclient-dev libpq-dev zlib1g-dev libyaml-dev libssl-dev \
   libgdbm-dev libreadline-dev libncurses5-dev libffi-dev \
   libxml2-dev libxslt-dev libcurl4-openssl-dev libicu-dev