Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

SRCH-5168 Fix suid & sgid deletion, remove crontabs and init files #255

Closed
wants to merge 2 commits into from
Closed

SRCH-5168 Fix suid & sgid deletion, remove crontabs and init files #255

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1ff0777
srch-5168 fix suid & sgid deletion, remove contabs and init files
stevenbarragan May 20, 2024
16f386a
Merge branch 'main' into SRCH-5168-container-hardering
stevenbarragan May 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion bin/secure_docker
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,16 @@ echo "echo -e 'This is a U.S. General Services Administration Federal Government
rm -fr /etc/sysctl* /etc/modprobe.d /etc/modules /etc/mdev.conf /etc/acpi

# Remove suid & sgid files to enforce simple permission sets.
find /bin /etc /lib /sbin /usr -xdev -type f -a \( -perm +4000 -o -perm +2000 \) -delete
find /bin /etc /lib /sbin /usr -xdev -type f -a \( -perm /4000 -o -perm /2000 \) -delete

# Check for calls out of the dockerfile to download software externally
apt-get remove -y --auto-remove curl

# Remove any broken symlinks, if any.
find /bin /etc /lib /sbin /usr -xdev -type l -exec test ! -e {} \; -delete

# Remove existing crontabs
rm -rf /etc/cron.d /etc/cron.daily

# Remove init scripts since we do not use them.
rm -fr /etc/init.d /lib/rc /etc/conf.d /etc/inittab /etc/runlevels /etc/rc.conf /etc/logrotate.d