Ensure setuid and setgid permissions are removed

MittelStufe 2Manuelle Prüfungdocker

Beschreibung

Removing setuid and setgid permissions in the images can prevent privilege escalation attacks within containers. setuid and setgid permissions can be used for privilege escalation. Whilst these permissions can on occasion be legitimately needed, you should consider removing them from packages which do not need them. Reported as a manual review item: the audit needs a site-specific judgement.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

You should run the command below against each image to list the executables which have either setuid or setgid permissions: docker export <IMAGE ID> | tar -tv 2>/dev/null | grep -E '^[-rwx].*(s|S).*\s[0-9]' You should then review the list and ensure that all executables configured with these permissions actually require them.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

You should allow setuid and setgid permissions only on executables which require them. You could remove these permissions at build time by adding the following command in your Dockerfile, preferably towards the end of the Dockerfile: RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true

Eigenschaften

Betriebssysteme: Beliebig
Tags: dockermanual
Referenz: CIS Docker Benchmark v1.9.0 - 4.7 Ensure setuid and setgid permissions are removed