Ubuntu Resolute base image contains world-writable /var/lib/pebble/default directory
Open
area-external
- Dominant language
- Dockerfile
- Stars
- 4.9k
- Forks
- 2k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 26
Description
The `ubuntu.azurecr.io:resolute` base image ships with `/var/lib/pebble/default` as a world-writable directory without the sticky bit set. This causes the `VerifyInsecureFiles` test to fail for all .NET 11.
`docker run --rm -u root --entrypoint /bin/sh ubuntu.azurecr.io/ubuntu:resolute -c "find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \)"`
Output:
```
/var/lib/pebble/default
```
Contributor guide
Assessment
This issue has not been assessed yet.