DNF update unsafe?

[tspearconquest]

According to #1032, the dnf update command should not be used, but the query url provided by kics only has recommendations regarding apt-get update and does not mention dnf.

The check below causes kics to fail for all dnf update commands and was merged by #1038:

kics/assets/queries/dockerfile/run_using_dnf_update/query.rego

Line 19 in c424d0c

containsCommand(cmds) = true {

The dnf update command does not work the same way as apt-get update, so this query is incorrectly disallowing a command that can be used without any issue. Unlike Debian based containers with apt-get, in the RPM based containers, the microdnf update command performs the same action as microdnf install:

microdnf install a specific package:

microdnf update specific package:

microdnf update no arguments performs the package upgrade, unlike apt-get which would simply update the metadata in the local apt cache:

I think there is a need to improve this query, because while it is encouraged not to use dnf update with no arguments or parameters, I think dnf update gzip is safe, because it does the same action as dnf install gzip, but with the only difference being that dnf update will not install a package name that is not already installed.

Any insight would be appreciated if I am wrong. I'd be willing to take a crack at improving this query too when I find some time.

[kaplanlior]

Hi, welcome to the KICS community. Thanks for raising this issue.

Notice dnf update is deprecated in favor of dnf upgrade, I guess to avoid the confusion you've mentioned.
https://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

[rafaela-soares]

Hi, @tspearconquest! Thank you so much for reaching us and explaining your point of view!

We deleted the query "Run Using dnf Update" in this PR. This query does not exist as of version 1.5.3.

[tspearconquest]

Ah yes, great, thank you.

It seems that even though my pre-commit hook is updated to the highest version v1.5.6, something is still pointing at my old kics binary v1.5.1 which doesn't get anymore updates.

I'll get the docker image setup with the hook here as soon as I can. Thanks again!

[rafaela-soares]

If you need any help, let us know 😊