andrewmusselman opened a new issue, #1360: URL: https://github.com/apache/tooling-trusted-releases/issues/1360
### Summary The runtime Docker image never drops privileges. Archive/SBOM tooling (`syft`, `cyclonedx`, `parlay`, `apache-rat`, `gpg`, `subversion`, `rsync`) parses attacker-influenced content as UID 0, maximising the blast radius of any parser vulnerability. ### Details **Data flow:** Authenticated committer uploads a release archive → archive/SBOM tooling parses attacker-influenced content → these binaries execute as UID 0 inside the container. The very defense ASVS 15.2.5 asks for (encapsulation/containerisation to contain risky components) is weakened because the "dangerous functionality" — parsing/processing untrusted release artifacts with multiple third-party parsers — runs as root. If any of these parsers has a memory-safety or command-injection defect, the attacker gains root within the container, maximising lateral movement and enabling tampering with the venv, certs (`state/hypercorn/secrets/`), and any mounted state. **Attacker capability:** Authenticated committer able to submit an artifact that a parser processes, plus a vulnerability in one of the parsing tools. **Impact on success:** Root-level code execution inside the container / full compromise of the container's writable state. **Affected files:** - `Dockerfile.alpine` - `start-atr.sh` **ASVS:** 15.2.5 (L3) ### Remediation Add a non-root user in the final Dockerfile stage and run as that user: ```dockerfile RUN addgroup -S atr && adduser -S -G atr atr && chown -R atr:atr /opt/atr USER atr ``` Additionally, consider a dedicated lower-privileged sub-process/sandbox (seccomp, read-only rootfs, `--cap-drop=ALL`) for the artifact-parsing tools. ### Acceptance Criteria - [ ] Fixed - [ ] Test added — assert that the container process does not run as UID 0 ### References - ASVS 15.2.5 - Source report: `15.2.5.md` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
