From ed9ff509529bb51d5b13ac84ac05b4d8da9d18fa Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 1 Dec 2021 11:33:26 +0100 Subject: [PATCH 1/8] angularjs-csti scanner now runs as NonRoot * A new user is added to the docker image * Path to wrapper.sh is changed to new user's home directory Signed-off-by: Ilyes Ben Dlala --- .../angularjs-csti-scanner/scanner/Dockerfile | 20 ++++++++++++++----- .../angularjs-csti-scanner/scanner/wrapper.sh | 8 ++++---- .../angularjs-csti-scanner-scan-type.yaml | 2 +- 3 files changed, 20 insertions(+), 10 deletions(-) diff --git a/scanners/angularjs-csti-scanner/scanner/Dockerfile b/scanners/angularjs-csti-scanner/scanner/Dockerfile index 59dfe9aaa1..ddbf2f4f27 100644 --- a/scanners/angularjs-csti-scanner/scanner/Dockerfile +++ b/scanners/angularjs-csti-scanner/scanner/Dockerfile @@ -4,8 +4,18 @@ FROM python:3.6-alpine ARG scannerVersion -COPY acstis-script.py /acstis/acstis-script.py -COPY wrapper.sh /wrapper.sh -RUN apk add --update --no-cache g++ gcc libxslt-dev -RUN pip install https://github.com/tijme/angularjs-csti-scanner/archive/$scannerVersion.zip -ENTRYPOINT [ "sh", "/wrapper.sh" ] + +RUN apk add --update --no-cache g++ gcc libxslt-dev \ + && pip install https://github.com/tijme/angularjs-csti-scanner/archive/$scannerVersion.zip + +RUN adduser -S -H -u 1001 angularjscsti + +COPY acstis-script.py /home/angularjscsti/acstis/acstis-script.py +COPY wrapper.sh /home/angularjscsti/wrapper.sh + +RUN pip install https://github.com/tijme/angularjs-csti-scanner/archive/$scannerVersion.zip \ + && chown -R angularjscsti /home/angularjscsti + +USER 1001 + +ENTRYPOINT [ "sh", "/home/angularjscsti/wrapper.sh" ] diff --git a/scanners/angularjs-csti-scanner/scanner/wrapper.sh b/scanners/angularjs-csti-scanner/scanner/wrapper.sh index 5a653dbb10..b8d5d2b29d 100644 --- a/scanners/angularjs-csti-scanner/scanner/wrapper.sh +++ b/scanners/angularjs-csti-scanner/scanner/wrapper.sh @@ -3,13 +3,13 @@ # SPDX-License-Identifier: Apache-2.0 # If acstis config exists paste it into the acstis script -if [ -f /acstis/config/acstis-config.py ]; then +if [ -f /home/angularjscsti/acstis/config/acstis-config.py ]; then echo "Insert acstis-config file into acstis script" - awk '{$1=$1}1' /acstis/config/acstis-config.py | # Trim start end end spaces of each line of the config + awk '{$1=$1}1' /home/angularjscsti/acstis/config/acstis-config.py | # Trim start end end spaces of each line of the config awk -v x=4 '{printf "%" x "s%s\n", "", $0}' | # Add indentation of 4 to every line - sed -i '/#INSERT CUSTOM OPTIONS HERE/ r /dev/stdin' /acstis/acstis-script.py # Insert config into script + sed -i '/#INSERT CUSTOM OPTIONS HERE/ r /dev/stdin' /home/angularjscsti/acstis/acstis-script.py # Insert config into script fi -python /acstis/acstis-script.py $@ +python /home/angularjscsti/acstis/acstis-script.py $@ # If no finding occurred generate a empty file for the lurker if [ ! -f /home/securecodebox/findings.log ]; then diff --git a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml index 470f3b7ba8..abd46bd9ca 100644 --- a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml +++ b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml @@ -28,7 +28,7 @@ spec: imagePullPolicy: {{ .Values.scanner.image.pullPolicy }} command: - "sh" - - "/wrapper.sh" + - "/home/angularjscsti/wrapper.sh" - "-vrl" - "/home/securecodebox/findings.log" resources: From ca9ae5374933af413667a7ae4ae27f835930d1b8 Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 1 Dec 2021 12:04:22 +0100 Subject: [PATCH 2/8] Removed redundent pip install the same archive was installed twice by mistake this resolves that Signed-off-by: Ilyes Ben Dlala --- scanners/angularjs-csti-scanner/scanner/Dockerfile | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/scanners/angularjs-csti-scanner/scanner/Dockerfile b/scanners/angularjs-csti-scanner/scanner/Dockerfile index ddbf2f4f27..42196d885f 100644 --- a/scanners/angularjs-csti-scanner/scanner/Dockerfile +++ b/scanners/angularjs-csti-scanner/scanner/Dockerfile @@ -5,9 +5,7 @@ FROM python:3.6-alpine ARG scannerVersion -RUN apk add --update --no-cache g++ gcc libxslt-dev \ - && pip install https://github.com/tijme/angularjs-csti-scanner/archive/$scannerVersion.zip - +RUN apk add --update --no-cache g++ gcc libxslt-dev RUN adduser -S -H -u 1001 angularjscsti COPY acstis-script.py /home/angularjscsti/acstis/acstis-script.py From a43c64b907391affa6f888ca0469fad3ee409c3e Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 1 Dec 2021 15:30:49 +0100 Subject: [PATCH 3/8] Allows using angularjscsti's configs * the mount path for the config volume is corrected * readOnlyRootFileSystem in values is set to false to allow writing the config file (see wrapper.sh) Signed-off-by: Ilyes Ben Dlala --- .../examples/scan-website-with-options/scan.yaml | 2 +- scanners/angularjs-csti-scanner/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml index a324cabf0e..639473cb7f 100644 --- a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml +++ b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml @@ -21,4 +21,4 @@ spec: name: "acstis-config" volumeMounts: - name: "acstis-config" - mountPath: "/acstis/config/" + mountPath: "/home/angularjscsti/acstis/config/" diff --git a/scanners/angularjs-csti-scanner/values.yaml b/scanners/angularjs-csti-scanner/values.yaml index cfac783b10..6f9f15b997 100644 --- a/scanners/angularjs-csti-scanner/values.yaml +++ b/scanners/angularjs-csti-scanner/values.yaml @@ -64,7 +64,7 @@ scanner: # scanner.securityContext.runAsNonRoot -- Enforces that the scanner image is run as a non root user runAsNonRoot: true # scanner.securityContext.readOnlyRootFilesystem -- Prevents write access to the containers file system - readOnlyRootFilesystem: true + readOnlyRootFilesystem: false # scanner.securityContext.allowPrivilegeEscalation -- Ensure that users privileges cannot be escalated allowPrivilegeEscalation: false # scanner.securityContext.privileged -- Ensures that the scanner container is not run in privileged mode From 2733ef07e850fe7f93cad3ba4bbfd8134b49174c Mon Sep 17 00:00:00 2001 From: Ilyes Ben Dlala Date: Wed, 1 Dec 2021 15:33:36 +0100 Subject: [PATCH 4/8] corrects the config file mount path of acstis scanner in docs this is the path to the volume mounted. to allow a config map to be used with angularjs-csti-scanner. Signed-off-by: Ilyes Ben Dlala --- scanners/angularjs-csti-scanner/.helm-docs.gotmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/angularjs-csti-scanner/.helm-docs.gotmpl b/scanners/angularjs-csti-scanner/.helm-docs.gotmpl index ba4b8a9f13..d006a125a3 100644 --- a/scanners/angularjs-csti-scanner/.helm-docs.gotmpl +++ b/scanners/angularjs-csti-scanner/.helm-docs.gotmpl @@ -80,7 +80,7 @@ Then, mount it into the container: name: "acstis-config" volumeMounts: - name: "acstis-config" - mountPath: "/acstis/config/" + mountPath: "/home/angularjscsti/acstis/config/" ``` #### Configuration options in *acstis-config.py* From 7e520e0c9dab5b1c6b5e045482ff14a9ab97dd6e Mon Sep 17 00:00:00 2001 From: Ilyesbdlala Date: Wed, 1 Dec 2021 14:36:42 +0000 Subject: [PATCH 5/8] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/angularjs-csti-scanner/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/angularjs-csti-scanner/README.md b/scanners/angularjs-csti-scanner/README.md index d0bab273c2..d11e5cbe8c 100644 --- a/scanners/angularjs-csti-scanner/README.md +++ b/scanners/angularjs-csti-scanner/README.md @@ -98,7 +98,7 @@ Then, mount it into the container: name: "acstis-config" volumeMounts: - name: "acstis-config" - mountPath: "/acstis/config/" + mountPath: "/home/angularjscsti/acstis/config/" ``` #### Configuration options in *acstis-config.py* @@ -185,11 +185,11 @@ options.scope.request_methods = [ | scanner.image.tag | string | `nil` | defaults to the charts appVersion | | scanner.nameAppend | string | `nil` | append a string to the default scantype name. | | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) | -| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | +| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":false,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) | | scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated | | scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. | | scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode | -| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system | +| scanner.securityContext.readOnlyRootFilesystem | bool | `false` | Prevents write access to the containers file system | | scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user | | scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | From 0a82eab93f9d4680264c44ddf8f1b91ce10c6249 Mon Sep 17 00:00:00 2001 From: Max Maass Date: Wed, 1 Dec 2021 16:00:18 +0100 Subject: [PATCH 6/8] Fix config paths, formatting in documentation Signed-off-by: Max Maass --- scanners/angularjs-csti-scanner/.helm-docs.gotmpl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/angularjs-csti-scanner/.helm-docs.gotmpl b/scanners/angularjs-csti-scanner/.helm-docs.gotmpl index d006a125a3..dbafe0325b 100644 --- a/scanners/angularjs-csti-scanner/.helm-docs.gotmpl +++ b/scanners/angularjs-csti-scanner/.helm-docs.gotmpl @@ -65,7 +65,7 @@ Optional arguments: Because *acstis* does not provide command line arguments for configuring the sent requests, you have to mount a config map into the scan container on a specific location. Your additional config map should be - mounted to `/acstis/config/acstis-config.py`. For example create a config map: + mounted to `/home/angularjscsti/acstis/config/acstis-config.py`. For example create a config map: ```bash kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config @@ -74,11 +74,11 @@ kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config Then, mount it into the container: ```yaml - volumes: + volumes: - name: "acstis-config" configMap: name: "acstis-config" - volumeMounts: + volumeMounts: - name: "acstis-config" mountPath: "/home/angularjscsti/acstis/config/" ``` From f7f3b4f375096cc454b6f85ed82e7fb903297f5d Mon Sep 17 00:00:00 2001 From: malexmave Date: Wed, 1 Dec 2021 15:00:49 +0000 Subject: [PATCH 7/8] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/angularjs-csti-scanner/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/angularjs-csti-scanner/README.md b/scanners/angularjs-csti-scanner/README.md index d11e5cbe8c..859dc8ca75 100644 --- a/scanners/angularjs-csti-scanner/README.md +++ b/scanners/angularjs-csti-scanner/README.md @@ -83,7 +83,7 @@ Kubernetes: `>=v1.11.0-0` Because *acstis* does not provide command line arguments for configuring the sent requests, you have to mount a config map into the scan container on a specific location. Your additional config map should be - mounted to `/acstis/config/acstis-config.py`. For example create a config map: + mounted to `/home/angularjscsti/acstis/config/acstis-config.py`. For example create a config map: ```bash kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config @@ -92,11 +92,11 @@ kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config Then, mount it into the container: ```yaml - volumes: + volumes: - name: "acstis-config" configMap: name: "acstis-config" - volumeMounts: + volumeMounts: - name: "acstis-config" mountPath: "/home/angularjscsti/acstis/config/" ``` From 056e20594f7dd5d072f132747a8baa7f9ed24735 Mon Sep 17 00:00:00 2001 From: Max Maass Date: Wed, 1 Dec 2021 16:03:25 +0100 Subject: [PATCH 8/8] Add empty commit to trigger CI Signed-off-by: Max Maass