Ensure setuid and setgid permissions are removed

MediaNivel 2Revisión manualdocker

Descripción

Removing setuid and setgid permissions in the images can prevent privilege escalation attacks within containers. setuid and setgid permissions can be used for privilege escalation. Whilst these permissions can on occasion be legitimately needed, you should consider removing them from packages which do not need them. Reported as a manual review item: the audit needs a site-specific judgement.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

You should run the command below against each image to list the executables which have either setuid or setgid permissions: docker export <IMAGE ID> | tar -tv 2>/dev/null | grep -E '^[-rwx].*(s|S).*\s[0-9]' You should then review the list and ensure that all executables configured with these permissions actually require them.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

You should allow setuid and setgid permissions only on executables which require them. You could remove these permissions at build time by adding the following command in your Dockerfile, preferably towards the end of the Dockerfile: RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: dockermanual
Referencia: CIS Docker Benchmark v1.9.0 - 4.7 Ensure setuid and setgid permissions are removed