Ensure setuid and setgid permissions are removed

СреднийУровень 2Ручная проверкаdocker

Описание

Removing setuid and setgid permissions in the images can prevent privilege escalation attacks within containers. setuid and setgid permissions can be used for privilege escalation. Whilst these permissions can on occasion be legitimately needed, you should consider removing them from packages which do not need them. Reported as a manual review item: the audit needs a site-specific judgement.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

You should run the command below against each image to list the executables which have either setuid or setgid permissions: docker export <IMAGE ID> | tar -tv 2>/dev/null | grep -E '^[-rwx].*(s|S).*\s[0-9]' You should then review the list and ensure that all executables configured with these permissions actually require them.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

You should allow setuid and setgid permissions only on executables which require them. You could remove these permissions at build time by adding the following command in your Dockerfile, preferably towards the end of the Dockerfile: RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true

Свойства

Операционные системы: Любая
Теги: dockermanual
Источник: CIS Docker Benchmark v1.9.0 - 4.7 Ensure setuid and setgid permissions are removed