aquasecurity / aquasecurity/tracee

Change user to non-root

Open
#1,946 1 comment 0 reactions 0 assignees View on GitHub
kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Prerequisites

- [ ] This issue is an EPIC issue (add label: EPIC).
- [ ] This issue is an EPIC TASK (add issue to EPIC description).

Select one OR another:

- [ ] I'll create a PR to implement this feature (assign to yourself).
- [ ] Someone else should implement this (describe it well).

## Feature description

Using a root user to run tracee is unnecessary as long as we have the minimal required capabilties (PR #1202 dropped unrequired capabilities).
Change user to a non-root one to reduce attack surface.

## Additional Information (feature drawings, files, logs, etc)

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating how Tracee is launched and where its required Linux capabilities and runtime user are configured; done means Tracee runs as a non-root user with only the capabilities it needs, verified by the relevant tests or runtime checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.