slimtoolkit / slimtoolkit/slim

sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set

Open
#151 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
23.4k
Forks
840
PR merge metrics
No merged PRs in 30d

Description

Hello,
I try to slim one of my container based on UBUNTU:18.04,
I've a x30 minify performance that is really great but I've a sudo command issue which I can't get rid of.
In my Dockerfile, I've an 'apt-get install sudo' command in a bash script called by the ENTRYPOINT
and I need it to load a driver at container start-up due to a USER switch.
The bash file contains this line: sudo /etc/init.d/<cmd> start
When I check the docker logs stdout, I've the following issue:
sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set
I tried to escalade the issue, using docker exec command in root mode, and I checked the file permission that should be 4755.
docker exec --user root -it 01 bash
bash-4.4# stat -c "%a" /usr/bin/sudo
755
In the container execution (docker exec --user root -it bash), I was able to change the sudo file permission (chmod 4755 /usr/bin/sudo) and after that, if I re execute the container the current user, I was able to execute the sudo command.
So, I think that my issue is related to a file permission.

Here is the docker-slim build command I used, but It doesn't fix the sudo permission issue:

docker-slim build --include-shell \ --include-exe='/bin/chmod' \ --include-exe='/bin/chown' \ --include-exe='/usr/bin/stat' \ --include-path='/usr/bin/sudo:4755' \ --include-path='/usr/lib' \ --include-path='/usr/tmp' \ --include-path='/var/tmp' \ my_container:ubuntu

I've also tried with others switch such as --path-perms-file='/usr/bin/sudo:4755' but with no luck.
Any idea to apply to resolve this issue ? Thanks.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported Dockerfile and ENTRYPOINT flow, then reproduce the docker-slim build command against Ubuntu 18.04. Compare /usr/bin/sudo ownership and mode before and after slimming, including the --include-path and --path-perms-file options. Done means the minimized image preserves uid 0 ownership and the setuid mode so the startup command succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, docker, ubuntu
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.