slimtoolkit / slimtoolkit/slim
sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.4k
- Forks
- 840
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
I try to slim one of my container based on UBUNTU:18.04,
I've a x30 minify performance that is really great but I've a sudo command issue which I can't get rid of.
In my Dockerfile, I've an 'apt-get install sudo' command in a bash script called by the ENTRYPOINT
and I need it to load a driver at container start-up due to a USER switch.
The bash file contains this line: sudo /etc/init.d/<cmd> start
When I check the docker logs stdout, I've the following issue:
sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set
I tried to escalade the issue, using docker exec command in root mode, and I checked the file permission that should be 4755.
docker exec --user root -it 01 bash
bash-4.4# stat -c "%a" /usr/bin/sudo
755
In the container execution (docker exec --user root -it bash), I was able to change the sudo file permission (chmod 4755 /usr/bin/sudo) and after that, if I re execute the container the current user, I was able to execute the sudo command.
So, I think that my issue is related to a file permission.
Here is the docker-slim build command I used, but It doesn't fix the sudo permission issue:
docker-slim build --include-shell \
--include-exe='/bin/chmod' \
--include-exe='/bin/chown' \
--include-exe='/usr/bin/stat' \
--include-path='/usr/bin/sudo:4755' \
--include-path='/usr/lib' \
--include-path='/usr/tmp' \
--include-path='/var/tmp' \
my_container:ubuntu
I've also tried with others switch such as --path-perms-file='/usr/bin/sudo:4755' but with no luck.
Any idea to apply to resolve this issue ? Thanks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reported Dockerfile and ENTRYPOINT flow, then reproduce the docker-slim build command against Ubuntu 18.04. Compare /usr/bin/sudo ownership and mode before and after slimming, including the --include-path and --path-perms-file options. Done means the minimized image preserves uid 0 ownership and the setuid mode so the startup command succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash, docker, ubuntu
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100