Skip to content

refactor: replace su-exec/gosu with setpriv#231

Merged
xoxys merged 1 commit into
masterfrom
remove-gosu
Sep 20, 2022
Merged

refactor: replace su-exec/gosu with setpriv#231
xoxys merged 1 commit into
masterfrom
remove-gosu

Conversation

@xoxys

@xoxys xoxys commented Sep 20, 2022

Copy link
Copy Markdown
Contributor

The used tool gosu/su-exec creates a lot of noise in the security scanning (even if the CVE's are not applicable). As the same functionality can be achieved by OS default tools this PR replaces gosu with setpriv.

usr/bin/su-exec (gobinary)
==========================
Total: 4 (UNKNOWN: 1, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

+--------------------------------+---------------------+----------+------------------------------------+-----------------------------------+----------------------------------------------+
|            LIBRARY             |  VULNERABILITY ID   | SEVERITY |         INSTALLED VERSION          |           FIXED VERSION           |                    TITLE                     |
+--------------------------------+---------------------+----------+------------------------------------+-----------------------------------+----------------------------------------------+
| github.com/opencontainers/runc | CVE-2021-43784      | MEDIUM   | v1.0.1                             | 1.1.0                             | runc: integer overflow in                    |
|                                |                     |          |                                    |                                   | netlink bytemsg length field                 |
|                                |                     |          |                                    |                                   | allows attacker to override...               |
|                                |                     |          |                                    |                                   | -->avd.aquasec.com/nvd/cve-2021-43784        |
+                                +---------------------+          +                                    +-----------------------------------+----------------------------------------------+
|                                | CVE-2022-24769      |          |                                    | v1.1.2                            | moby: Default inheritable                    |
|                                |                     |          |                                    |                                   | capabilities for linux                       |
|                                |                     |          |                                    |                                   | container should be empty                    |
|                                |                     |          |                                    |                                   | -->avd.aquasec.com/nvd/cve-2022-24769        |
+                                +---------------------+----------+                                    +-----------------------------------+----------------------------------------------+
|                                | GHSA-v95c-p5hm-xq8f | UNKNOWN  |                                    | 1.1.0                             | An attacker with partial control             |
|                                |                     |          |                                    |                                   | over the bind mount sources of a...          |
|                                |                     |          |                                    |                                   | -->github.com/advisories/GHSA-v95c-p5hm-xq8f |
+--------------------------------+---------------------+----------+------------------------------------+-----------------------------------+----------------------------------------------+
| golang.org/x/sys               | CVE-2022-29526      | MEDIUM   | v0.0.0-20210817142637-7d9622a276b7 | 0.0.0-20220412211240-33da011f77ad | golang: syscall: faccessat                   |
|                                |                     |          |                                    |                                   | checks wrong group                           |
|                                |                     |          |                                    |                                   | -->avd.aquasec.com/nvd/cve-2022-29526        |
+--------------------------------+---------------------+----------+------------------------------------+-----------------------------------+----------------------------------------------+

Reference: https://github.com/tianon/gosu#setpriv

@xoxys

xoxys commented Sep 20, 2022

Copy link
Copy Markdown
Contributor Author

@d7oc FYI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants