The InstalledFile of dpkg package has directory

[y4ney]

Description

When identifying the installed files of dpkg, only adjacent directories can be removed. Do you consider sorting first?

Desired Behavior

The installed file does not contain the /etc directory.

Actual Behavior

The installed file contain the /etc directory.

Reproduction Steps

1.scan image `debian:latest`
trivy image --list-all-pkgs --format json --output test/debian_latest.json debian:latest
2. select the `/etc` directory in InstalledFile

cat test/debian_latest.json | jq '.Results[].Packages[] | select(any(.InstalledFiles[]; . == "/etc"))'
{
  "ID": "tar@1.34+dfsg-1.2+deb12u1",
  "Name": "tar",
  "Identifier": {
    "PURL": "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=arm64&distro=debian-12.5"
  },
  "Version": "1.34+dfsg",
  "Release": "1.2+deb12u1",
  "Arch": "arm64",
  "SrcName": "tar",
  "SrcVersion": "1.34+dfsg",
  "SrcRelease": "1.2+deb12u1",
  "Licenses": [
    "GPL-3.0",
    "GPL-3+ with Bison exception",
    "LGPL-3.0",
    "GPL-2.0"
  ],
  "Maintainer": "Janos Lenart <ocsi@debian.org>",
  "Layer": {
    "DiffID": "sha256:b10a49b17ae62fcf1c89fbf0473a879599168554d24490433ec580f685c2b879"
  },
  "Digest": "sha256:04a945d4f24068f9d4c44294014ef5a33fc6179a57021978afc7d08358e13df3",
  "InstalledFiles": [
    "/bin/tar",
    "/etc",
    "/usr/lib/mime/packages/tar",
    "/usr/sbin/rmt-tar",
    "/usr/sbin/tarcat",
    "/usr/share/doc/tar/AUTHORS",
    "/usr/share/doc/tar/NEWS.gz",
    "/usr/share/doc/tar/README.Debian",
    "/usr/share/doc/tar/THANKS.gz",
    "/usr/share/doc/tar/changelog.1.gz",
    "/usr/share/doc/tar/changelog.Debian.gz",
    "/usr/share/doc/tar/changelog.gz",
    "/usr/share/doc/tar/copyright",
    "/usr/share/locale/bg/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ca/LC_MESSAGES/tar.mo",
    "/usr/share/locale/cs/LC_MESSAGES/tar.mo",
    "/usr/share/locale/da/LC_MESSAGES/tar.mo",
    "/usr/share/locale/de/LC_MESSAGES/tar.mo",
    "/usr/share/locale/el/LC_MESSAGES/tar.mo",
    "/usr/share/locale/eo/LC_MESSAGES/tar.mo",
    "/usr/share/locale/es/LC_MESSAGES/tar.mo",
    "/usr/share/locale/et/LC_MESSAGES/tar.mo",
    "/usr/share/locale/eu/LC_MESSAGES/tar.mo",
    "/usr/share/locale/fi/LC_MESSAGES/tar.mo",
    "/usr/share/locale/fr/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ga/LC_MESSAGES/tar.mo",
    "/usr/share/locale/gl/LC_MESSAGES/tar.mo",
    "/usr/share/locale/hr/LC_MESSAGES/tar.mo",
    "/usr/share/locale/hu/LC_MESSAGES/tar.mo",
    "/usr/share/locale/id/LC_MESSAGES/tar.mo",
    "/usr/share/locale/it/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ja/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ko/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ky/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ms/LC_MESSAGES/tar.mo",
    "/usr/share/locale/nb/LC_MESSAGES/tar.mo",
    "/usr/share/locale/nl/LC_MESSAGES/tar.mo",
    "/usr/share/locale/pl/LC_MESSAGES/tar.mo",
    "/usr/share/locale/pt/LC_MESSAGES/tar.mo",
    "/usr/share/locale/pt_BR/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ro/LC_MESSAGES/tar.mo",
    "/usr/share/locale/ru/LC_MESSAGES/tar.mo",
    "/usr/share/locale/sk/LC_MESSAGES/tar.mo",
    "/usr/share/locale/sl/LC_MESSAGES/tar.mo",
    "/usr/share/locale/sr/LC_MESSAGES/tar.mo",
    "/usr/share/locale/sv/LC_MESSAGES/tar.mo",
    "/usr/share/locale/tr/LC_MESSAGES/tar.mo",
    "/usr/share/locale/uk/LC_MESSAGES/tar.mo",
    "/usr/share/locale/vi/LC_MESSAGES/tar.mo",
    "/usr/share/locale/zh_CN/LC_MESSAGES/tar.mo",
    "/usr/share/locale/zh_TW/LC_MESSAGES/tar.mo",
    "/usr/share/man/man1/tar.1.gz",
    "/usr/share/man/man1/tarcat.1.gz",
    "/usr/share/man/man8/rmt-tar.8.gz",
    "/etc/rmt"
  ]
}

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

2024-04-23T18:27:25.311+0800	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2024-04-23T18:27:25.312+0800	DEBUG	Ignore statuses	{"statuses": null}
2024-04-23T18:27:25.323+0800	DEBUG	cache dir:  /Users/yaney/Library/Caches/trivy
2024-04-23T18:27:25.324+0800	DEBUG	DB update was skipped because the local DB is the latest
2024-04-23T18:27:25.324+0800	DEBUG	DB Schema: 2, UpdatedAt: 2024-04-23 06:12:13.734267443 +0000 UTC, NextUpdate: 2024-04-23 12:12:13.734267082 +0000 UTC, DownloadedAt: 2024-04-23 06:51:30.935031 +0000 UTC
2024-04-23T18:27:25.324+0800	INFO	Vulnerability scanning is enabled
2024-04-23T18:27:25.324+0800	DEBUG	Vulnerability type:  [os library]
2024-04-23T18:27:25.325+0800	INFO	Secret scanning is enabled
2024-04-23T18:27:25.325+0800	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-04-23T18:27:25.325+0800	INFO	Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-04-23T18:27:25.325+0800	DEBUG	Enabling misconfiguration scanners: [azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-04-23T18:27:25.357+0800	DEBUG	No secret config detected: trivy-secret.yaml
2024-04-23T18:27:25.358+0800	DEBUG	The nuget packages directory couldn't be found. License search disabled
2024-04-23T18:27:25.359+0800	DEBUG	No secret config detected: trivy-secret.yaml
2024-04-23T18:27:25.359+0800	DEBUG	Image ID: sha256:8138bbd6ac4e6145d04bb9e21475581e89c90c499a2385e45563d6135be136cb
2024-04-23T18:27:25.359+0800	DEBUG	Diff IDs: [sha256:b10a49b17ae62fcf1c89fbf0473a879599168554d24490433ec580f685c2b879]
2024-04-23T18:27:25.359+0800	DEBUG	Base Layers: []
2024-04-23T18:27:25.370+0800	INFO	Detected OS: debian
2024-04-23T18:27:25.370+0800	INFO	Detecting Debian vulnerabilities...
2024-04-23T18:27:25.370+0800	DEBUG	debian: os version: 12
2024-04-23T18:27:25.370+0800	DEBUG	debian: the number of packages: 88
2024-04-23T18:27:25.379+0800	INFO	Number of language-specific files: 0

Operating System

macOS Big Sur

Version

Version: 0.50.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-04-23 06:12:13.734267443 +0000 UTC
  NextUpdate: 2024-04-23 12:12:13.734267082 +0000 UTC
  DownloadedAt: 2024-04-23 06:51:30.935031 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-04-23 00:47:52.368873767 +0000 UTC
  NextUpdate: 2024-04-26 00:47:52.368873587 +0000 UTC
  DownloadedAt: 2024-04-23 06:56:50.244629 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[knqyf263]

Trivy shows the same list as dpkg.

$ docker run --rm -it debian:latest dpkg-query -L tar | grep etc
/etc
/etc/rmt

[y4ney]

Yes,I got it.But Trivy should show the files not directories,see here

[knqyf263]

I got it. Created #6548