bootBuildImage /workspace files may be world writeable #36639
Labels
for: external-project
For an external project and not something we can fix
status: declined
A suggestion or change that we don't feel we should currently apply
Using Spring Boot's cloud native buildpack functionality to create a docker image., the
/workspace
directory in the image will have files with permissions that come from the building system's file system.For example, if the build process creates a file at
./build/generated-resources/static/favicon.ico
that is world writable (chmod 666
), then that file will be world writable in thebootBuildImage
produced docker image at/workspace/BOOT-INF/classes/static/favicon.ico
. This can be done by runningumask 0000
before running./gradlew bootBuildImage
.No files under
/workspace
should world writable. World writable files are a violation of recommendations from the CIS Benchmarks and other security standards, example documentation: https://www.tenable.com/audits/items/CIS_SUSE_Linux_Enterprise_Workstation_11_v2.1.0_L1.audit:ffc7b53d7c43ea8da23cd2e6aa9e19c3When
bootBuildImage
adds the files to the docker image, it should unset the world writable permission.The text was updated successfully, but these errors were encountered: