Ensure setuid and setgid permissions are removed

SedangLevel 2Tinjauan manualdocker

Deskripsi

Removing setuid and setgid permissions in the images can prevent privilege escalation attacks within containers. setuid and setgid permissions can be used for privilege escalation. Whilst these permissions can on occasion be legitimately needed, you should consider removing them from packages which do not need them. Reported as a manual review item: the audit needs a site-specific judgement.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

You should run the command below against each image to list the executables which have either setuid or setgid permissions: docker export <IMAGE ID> | tar -tv 2>/dev/null | grep -E '^[-rwx].*(s|S).*\s[0-9]' You should then review the list and ensure that all executables configured with these permissions actually require them.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

You should allow setuid and setgid permissions only on executables which require them. You could remove these permissions at build time by adding the following command in your Dockerfile, preferably towards the end of the Dockerfile: RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true

Properti

Sistem operasi: Apa saja
Tag: dockermanual
Referensi: CIS Docker Benchmark v1.9.0 - 4.7 Ensure setuid and setgid permissions are removed