diff --git a/controllers/terminal/Dockerfile b/controllers/terminal/Dockerfile index fc4c530a8..a4ea9c82b 100644 --- a/controllers/terminal/Dockerfile +++ b/controllers/terminal/Dockerfile @@ -2,8 +2,7 @@ FROM gcr.io/distroless/static:nonroot ARG TARGETARCH WORKDIR / -RUN useradd -u 1337 terminal -USER terminal +USER 65532:65532 COPY bin/controller-terminal-$TARGETARCH /manager ENTRYPOINT ["/manager"] diff --git a/controllers/terminal/deploy/manifests/deploy.yaml b/controllers/terminal/deploy/manifests/deploy.yaml index 96066c0f4..2997bfa19 100644 --- a/controllers/terminal/deploy/manifests/deploy.yaml +++ b/controllers/terminal/deploy/manifests/deploy.yaml @@ -406,6 +406,7 @@ spec: cpu: 10m memory: 64Mi securityContext: + runAsNonRoot: true allowPrivilegeEscalation: false capabilities: drop: diff --git a/controllers/user/deploy/manifests/deploy.yaml b/controllers/user/deploy/manifests/deploy.yaml index 45b191643..8809f67cb 100644 --- a/controllers/user/deploy/manifests/deploy.yaml +++ b/controllers/user/deploy/manifests/deploy.yaml @@ -987,6 +987,7 @@ spec: cpu: 5m memory: 64Mi securityContext: + runAsNonRoot: true allowPrivilegeEscalation: false capabilities: drop: diff --git a/docker/lvscare/Dockerfile b/docker/lvscare/Dockerfile index b60040983..effb5b7e9 100644 --- a/docker/lvscare/Dockerfile +++ b/docker/lvscare/Dockerfile @@ -8,4 +8,5 @@ RUN --mount=target=/build tar xf /build/dist/sealos_*_$(echo ${TARGETPLATFORM} | # nosemgrep: dockerfile.security.missing-user.missing-user ENTRYPOINT ["/usr/bin/lvscare"] +# nosemgrep: dockerfile.security.missing-user.missing-user CMD ["--help"] diff --git a/docker/sealos/Dockerfile b/docker/sealos/Dockerfile index ea42c1d6c..9550fa414 100644 --- a/docker/sealos/Dockerfile +++ b/docker/sealos/Dockerfile @@ -7,4 +7,5 @@ RUN --mount=target=/build tar xf /build/dist/sealos_*_$(echo ${TARGETPLATFORM} | # nosemgrep: dockerfile.security.missing-user.missing-user ENTRYPOINT ["/usr/bin/sealos"] +# nosemgrep: dockerfile.security.missing-user.missing-user CMD ["--help"] diff --git a/docker/sealos/Dockerfile.main b/docker/sealos/Dockerfile.main index 5f323cd15..159ff0ef3 100644 --- a/docker/sealos/Dockerfile.main +++ b/docker/sealos/Dockerfile.main @@ -4,5 +4,4 @@ ARG TARGETARCH WORKDIR /usr/bin/ COPY --chmod=0755 /bin/sealos-$TARGETARCH/sealos . -# nosemgrep: dockerfile.security.missing-user.missing-user ENTRYPOINT ["/usr/bin/sealos"] diff --git a/fork/github.com/heroku/docker-registry-client/registry/registry.go b/fork/github.com/heroku/docker-registry-client/registry/registry.go index 745bb47bc..c7a97f7bd 100644 --- a/fork/github.com/heroku/docker-registry-client/registry/registry.go +++ b/fork/github.com/heroku/docker-registry-client/registry/registry.go @@ -34,8 +34,8 @@ func New(registryURL, username, password string, logFunc LogfCallback) (*Registr * SSL certificate verification. */ func NewInsecure(registryURL, username, password string, logFunc LogfCallback) (*Registry, error) { - // nosemgrep transport := &http.Transport{ + // nosemgrep TLSClientConfig: &tls.Config{ // TODO: Why? InsecureSkipVerify: true, //nolint:gosec diff --git a/pkg/cert/pki/etcd/ca.key b/pkg/cert/pki/etcd/ca.key deleted file mode 100644 index 93e355511..000000000 --- a/pkg/cert/pki/etcd/ca.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEA3LTJR5Q8qHyyd7YHSO+Ao7cKiDixsnIAmF2JfdndfAudUeTW -P/xWLcFMVYWOuhlfuIStueuBC5nPmk5KKlTkNCjXys1SpnZnGDwdEcWF0irGVgnb -67yHkAUghN2i0vaWjQHgWNYhdW79l6MW0sraXJfrCyxXiI/yJ0lQOJI9QOSUpKGe -sDBxJ6CQJ8mxZ4oMCfc9aoIspuUXCkG7WOju1w6lfk/iwQoeC0VcGaSq1gXywqvU -uZHxIS9zp+GNQPCAJN4OlH5qcf2e3QYECX1igr8xcZfpjnTTKJHzFjzg2mGhc6KG -yMDXzU3LyLS5fvUSpITtsgq8ufsSSrkU3SNzUwIDAQABAoIBAA5sdjcKVgiA1b0D -FWjL1jFc1gBfDCXoU2ehvUmPQm1H6QkgFmxqFku5NT7lkpVQ8TOC4EOlQ3K5o5qn -ASvRDnTmMmwbjQo59LTdwNyXdw5sIzgePtQiJw3fd+eXAHwfB2nBtKK5o8gj78jI -LMar4Sdp+j9pr3LKTX4JyYdY703dQ0ZVtRIab3MXAqjUXwZxH16KC0yfz/PVOtVA -RtYsDaFujyIlKz0MtsFIT+5FXvpFh44nilavfgypkNXgpoaxRfIxAiVAlHO3WbBW -cPC1HwnJ2rb/gBxcmGjSDjxwbPZ7H57O7oI0a6LQjDfz/qu6SlYcuwT7H9CrZMGg -gV3DeWkCgYEA4C3P1kJMaLwhMJ1ZgHwdlwAYNQiF4oQMrCFooXEyf841xgfQzveN -A0jxjuCuwUYn6pLzjn5qq3jypMoPcMSyw8FkEO1qgJG1osNIvA6T9dRo8kJuEo8X -Aefy3R+pydLa8owR/cI87fYizzF9T7BEPqquMAdppr44ErsU6jBrVLUCgYEA/AjI -IrHwnI+w/47Mub8+cdTFCrvQn0WAdFMdWsoxNy3k2mZmXm2fi15EMEnMS/d68RLn -hhzrVmJEulamJ8L2ZATciIuZdchicG8VudXZmbGwxSPp4M7o293pUXc47lSvgDox -9VKbtj5xCVoOypfxUTt2rkNGuVm1pNPDyTtIdOcCgYAjaDjuX1RQKn6XfhK3z2Kh -CdvI7Iqw5yhVO4WaEhXmx7wIhg190u2LukakyWnwjtMZIpKjS+YvJRA15NAhgH+3 -mWDjp4vtuJXWmj9vrGHELwNQWBuohL8ehvL959VaUhpQurzQtpAHCZwf23IuVunA -eBbA8TrHoj2a/79i6bjaDQKBgQDySw78K8yA9rLWPFYci/pgPIhhVUWumIZxTiX+ -TjsaLQjB3Ye0Z/blaO5s7cV1kqmicOYbTFoCZd5ktUBvIUL1zKamrm4NiWL5bBGa -4jebRfQG0gvZj5DVLnVLWC5nEQrXXxsAGTaQ8V6B+w4VPhVEXsItrYekUNYLa3nh -TxjNKQKBgQCr1EpTOpGE+G3eV3F+PeLpINTAMAr+WTMEL9jhAVmeKoavWWOs+Q6t -RV/aG4NIlAQ4ggIOki1Ov6xnQRu0U1i1ZkTubnmcj7mQQFA8AiI3AcBurfxaA/WC -nhXqCzi0C6SvQlVOf2jg7Jp7cgBp/UIqzpHMxhVRgz7GmDxAx4rqiA== ------END RSA PRIVATE KEY----- diff --git a/pkg/cert/pki/etcd/healthcheck-client.key b/pkg/cert/pki/etcd/healthcheck-client.key deleted file mode 100644 index d4feab8bd..000000000 --- a/pkg/cert/pki/etcd/healthcheck-client.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEAtMjXZrtqu49zffuKVcoXC4hmD4nExuI884P5L1+oE1PbKgKq -/c0m7JvDnYU9JQhlrtjBWZXJCozitDicL2lod0/JNG7xsaw5RdL2jiSu5AOJzVJx -+s0uh11x1DKFSdKG048RMjFuyWfOZXM3weU/wC4hEZ+Q7kUmlg/yQC5f+/fT7uaw -RWRHkPBPcFj3U8DhdIiCy1l1KwHOjUtAey/MlTcTPuKFRpD5LEEfMMIZ0nstPEPa -wdAn4R0r4KwmlZhBH30Z+g1C/gqIO0M4WvwH2nziWs/e4c6vJkuSruIeTwl5vdBe -1ERP3eKjpyBlnHpRpXA7UeNqBTyMAih3YsgqAwIDAQABAoIBAQCQB7b85PIa7iXw -SBglUzVa/dd6J6O7ZAF1bT54zLgGdfeVF70NKYYKWerWM5HMUE1aqNwaOGiMXEQ9 -myBr8YnGDK3bdUxf5jtW8sV156nihSMjjry6OQAJ3pvSmFFyyCScpk3n9FQ0Z9yb -HNleQ/uva9DyznLUMgmU4q15Drlv7uECaCFzvmkoJgjZ0LG0dn3DI83EFPcVakhy -Td1vkXRcxys4pxYMyS9XkzmSTlY6sCqHw+n1ioUlhjvV/usnUYu96qGOYnDKcWZN -GYrt+TeAXTOTRH5+fDm1RMXoGCGf4XxKJJIOchmKkXf8IdhrJPhHqo5VEfzFYfqr -NQPLzur5AoGBAMPpaG3TyFXRTpIh3MkMliub62yexLVLQrmXpmrnOMb2QWSl2sOR -It4J4+bNv37flmWL4zCXmZkahys5OdmiRv21T1nlj8AXBRcLdPPSKGUgdpSwHtVH -QajRsLie9zYirsCPierUzACd17W6/MfDbFHhDqpECZP/kke0kBDyEp5FAoGBAOw7 -rO1LSv3SZ4f4+WVRd5GNFIno7Qv08LSr80sTe4aUDYZ4+RfhI558klBmJgbakCX9 -E+3nBSgcminWjj82CzMDESJWAQxI7Z6nl263oUUP2lzxM39easL8Rm0iDbg1C/7C -zqM/fNIFADQt6yQmlXT4VYPbaYnkO5nhCOd7p2+nAoGAeBluW2WpOnLFp+/6WYXN -yY4cFMp/7GPm07+T1ZVJyS7Nh9Xk9l7S8Ss++w7GhhCrMjU/YVqOXr1Uf7rlK/W/ -b2jm7EU+ipOSGz56w73h5ZyxFRWi0TyNk+B4ZbWN9zHrz0AvXDZ3mSkqQ84NiKjU -jp1ZUCfFd2UFV8/pQXokz8ECgYEAhc4zX+Ey49xGmiTzFmlzoXTYuli90/T0VlHD -J7YsVIkNtCpXZSg35bBHq9SAG4e2+F2F6U3ehN7Wj3Yg8jrpUwacsOcoBs5UEXZ5 -9tN6PEUDeXuBoNZZAIKmXXBZdwpM9gtfweXXDJqah/OuabaVF0EGJv6jo+ArxjhJ -s9w9dacCgYBWTq22aNZubiZFbk+E1NaqqNwEDQeVo6/YLwTvEP2ZzRsI2xAR5hcc -R5hTbotkFBo5B0gUqoAMh49qkYbEsn1mjNjkdoztoIh0q2q6G+reCysbG67IQBRO -jI9Zco4+7J5JsmvY9h/bxIx+4/U/1h1e0xXJ4m1l1IAtKK9Zb7H2WA== ------END RSA PRIVATE KEY----- diff --git a/pkg/cert/pki/etcd/peer.key b/pkg/cert/pki/etcd/peer.key deleted file mode 100644 index 2e1f4ad58..000000000 --- a/pkg/cert/pki/etcd/peer.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEowIBAAKCAQEA3EV4H327BdG6LOX14YyF9zs0Vi8iOD1239oiATc6+f0QCmbw -LB7NUxPcox3rMa3pUqAos6DRUUB6AKmrtjdCVm4DBVPbnFGiNX4QMXmh8s22mPdY -JiFsyqlHAvOblqW+sDz8G9vz/dx7K6iTCz1DNiwQvGSCr2zd1oaVQ19hM7JLB3lx -Y+o9VWa9q4poBFg57D+SJ/XPTV6aOJzJgGrhiBra6ZIRyA2uEu1llxgD6Tu5cg5F -VCcSeLQgqPdrBBN/J3Xn32WbHQI6ooNUefjrjiozuI1lmZOEwwfHvSZlevD008q2 -UnStFbvJTXM6IkTQoibrjMFAO4fIsuO32xhRRQIDAQABAoIBAFVNgeuQIXFrexIQ -LFygsvC/uND3h+UHyJWAQFMANJLDcgbVPoWXmCRoOLXizEZ89zLMW3bU/LreoWDI -VHtIgyQ9jmXtx8qNwqe8nkDKvfDtwZ0TjMuXfi4tyBZYiRSaM3LE601OrPrO+9Q4 -gFmF7BV6kzCiLAoLuw1tKTjiIx6FYX4DFN3zSfO2IyDuxq8R49jUHj37qA8HcLYL -6OBfyr/bfaU9KWYAmpfEZT71Z1ms4A7OGgNt8IohTfFy3qEdqfna+Ddm2cZ/OCTe -HFlRVo9i3wh2KJkHoD8NCQd6MBVZ7sc45SveVcgLs+eyBEn34IGmHbcW5CDyrTv0 -rLtos4ECgYEA9ztud6edlkG4b5Fj28gSdeA6iC7He6m2bVhLcpvbqZQObnAYdh9v -eRmQu/ZQpkzo6lNrsLocqdceU44Sql0Kaes/SHW5KqzvxZk/gtQpCMks1eCCB+b3 -BtwUkCmR+cAzFRvSCDufyXifpK52mcGLpDb7ACpOhIAdAByCZ7xUA50CgYEA5BVE -MtDVlyZmnuK8PO98pfYSSDUJTuRB0XnUrcv7RqSfoj/U4ta2z/uCswkMYClp6QaG -u6RUXVVaAbB9tMpqpodUVlx9V7tjsFhSXzCWeUFnkzq4cVrQhrYJcoSUJI/+gg/u -OexZ+fEYy3X5pBcCGG5+b1i375RK9+M4rUep98kCgYEAx2ux9GRIkc3bNmshEEP2 -2AwRSo3pLI+9bb/dw8mCSuv5JA3ZPVan9RexDlxlu26oJXM6l2fX/QtfE+iyl6bK -4pr2Bb2nqYurMEkn2KDHpKWZO7+HQ1aDBY56K7rMW5cz3R/+r9NgVQOuSgjL88QR -nlkW55A4m1o3ikJ00bYwUmUCgYBIUMHVxsbh7Kf+2m7KdzgzOojjYgV4gQCpVRJs -pE8gP9PpUonB/kfqO5leAJFu79KHsq0HU3v4N7aY8Id6ye70q9W+qAaJyX07DVXY -noQnH+iiEq0mK6AQBimKqKR7zzfnrvteXCTPDXVKFTa4ox7j9iyaSyvOh1sZq25t -6lnmmQKBgGavNz+vpFrQf43gNmQj8R/I4A+zxQbbrulFLW0r2JTSxXpXgYUO5Q+J -oj5HTHdjHXm7sdD1HRSgHe0wHgGR4XeotzDWffxM1o4au8lGZ/zHZnpQEecLPjcU -W/skF5EbjMP5unulol4lDkihktV3+6JgUUUoLALeCoe1zfwPmmi4 ------END RSA PRIVATE KEY----- diff --git a/pkg/cert/pki/etcd/server.key b/pkg/cert/pki/etcd/server.key deleted file mode 100644 index f7c30d9c2..000000000 --- a/pkg/cert/pki/etcd/server.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEowIBAAKCAQEAt0Dkl19VEGF7zTkQBLV50daIkkjx3CfJDSb+A1kqIqopDW26 -owaimFRr+jwQuEwPJr5iz+CkVfw4BFYxGRMqQYgnT6gfqiZo0pGDfrh5B+OGAyGU -n+SUtqboMpf+ilcu9XXowH5KNcF1zw88c/16a/RCJylZih8yqheB8d+8R9hL9EWS -X1sbYb0sScSt1FnoBo0tvM7yUX7oHUC2YPn/QIU08KjHYbn5f4HgfdZyYQza6p7n -Z2X6zH3k1E3LN5cZPD4+9kO19ggdHZYOYeUn++DwzESCn5YchmMkEyvK0DPfnTwo -Y3BewN2ESx01lXJbYLITXKuqpu2S1SKJ98B8qQIDAQABAoIBADpW7m9CalJMtp0f -DXpyS9YB9nibwGPWRqtpPnTSbhebFHax+DjuY9UbC0Ue2jPSAwDSm6KSYb7+DNdU -mUziTRGPxvQVEf+ZOsXOjY5KLD3WsVNN3YMJwk5j1IhG20Ivf0OlxfOCQR3b+SVy -NEy45cB4gpb1Ewxl4jtEQJpAIDC+oMG/0y0JPmlj6pHfwB5nku4iekocQCX7RzYP -QBa0PNWvrvNlRJha5DpNHN5zQ2zqg+syKwO0P3oqSjmeAjV4viQmLuBuyDFdLniM -TcWVE3FJIsbdkHNJFwDCdxdWFu/UuO9e8KkrQ2pM5X+sLiqdPqKTefQoxfWH5pDP -ULF5ZgECgYEA8Liujr8yaozEytFIIw20qIbcIWG8+NcHVsDA/inlxF1GyKAfAtOx -I9DtGinVoqtP0DIp1es5ppe8K0qD0WzbKJQlTaXhJivWxFocw0wJp+rmKQIDrauq -X+5+WSR9SqT8wa1XGRDxUfGnpzgnmzDiMgJMPLaVWTLA9fhm/lfq83MCgYEAwuJ0 -NIwtp5KV+fCB0XkzkB2pfBpmqJFL0rgZwSw6eAR25/Uys07TelR0S0phxRtCuZIZ -tClV6NbL4SWQs6nQgl0M7hd7MSmJsTuvZlm/tWMVO9CIAYG+EH881/cob5r5XX6F -pf7qFffYOMwRT4MMg619C/QwTfDc9IKMzZPuYHMCgYB9COCagtN0JsQ9OPGIS6Ev -/ESxDixy8HX+aMaV/js7gNu4b/tLo5uaJ/ZQJbSy9trRII08cR8T2jLCJcVMbYd0 -j2bE60mEYzb97HSOOJu3XbrJSCOS/NzVUXLNaLevov0quJfKDFPcpXHY2MExyfVj -1m+1BX2TxFoYKTuOFyqR4wKBgGKoMz26zQ3s9kGeUInTupe1fGxYDSo+y8yz6E3T -bxH86JkKlw0Q1ZwzDuBimlYnM8MvxBVha51Ax9uFodhiGi00n+wUNQgxSARR+7xr -qNJRg5lROtjQboB5eTq3Y2AEa0K6XzwmbSiL3Ij8PbMr23T5qbkYeC+sxJ5/THpx -7hYjAoGBAJzUSul7/TMPZf0+iidxNeKzgjdQPYRW0tVEvn+6F1+JRiUlXeC2Qnso -hVXQMMsxeqPSlUnGaoXc9OujnH8TL7WkkmeUTr63jl7e2nWW1cHh6sC5n9TAzLVG -Oj0D7I1yfZWp7EY+ECPfZI232sO5ONR62JizAcLbGTBqSRWs0EdQ ------END RSA PRIVATE KEY----- diff --git a/pkg/registry/distributionpkg/client/blob_writer.go b/pkg/registry/distributionpkg/client/blob_writer.go index ee7a78235..6afb24262 100644 --- a/pkg/registry/distributionpkg/client/blob_writer.go +++ b/pkg/registry/distributionpkg/client/blob_writer.go @@ -102,10 +102,12 @@ func (hbu *httpBlobUpload) Write(p []byte) (n int, err error) { } hbu.uuid = resp.Header.Get("Docker-Upload-UUID") - hbu.location, err = sanitizeLocation(resp.Header.Get("Location"), hbu.location) + location, err := sanitizeLocation(resp.Header.Get("Location"), hbu.location) if err != nil { return 0, err } + hbu.location = location + rng := resp.Header.Get("Range") var start, end int if n, err := fmt.Sscanf(rng, "%d-%d", &start, &end); err != nil { diff --git a/pkg/registry/distributionpkg/proxy/proxyauth.go b/pkg/registry/distributionpkg/proxy/proxyauth.go index 51725e13c..bcebcacaf 100644 --- a/pkg/registry/distributionpkg/proxy/proxyauth.go +++ b/pkg/registry/distributionpkg/proxy/proxyauth.go @@ -124,9 +124,9 @@ func ping(manager challenge.Manager, endpoint string) error { // #nosec func newClientSkipVerify() *http.Client { - // nosemgrep return &http.Client{ Transport: &http.Transport{ + // nosemgrep TLSClientConfig: &tls.Config{ InsecureSkipVerify: true, }, diff --git a/staging/src/github.com/labring/image-cri-shim/pkg/cri/cri.go b/staging/src/github.com/labring/image-cri-shim/pkg/cri/cri.go index 07186a422..de1e30d91 100644 --- a/staging/src/github.com/labring/image-cri-shim/pkg/cri/cri.go +++ b/staging/src/github.com/labring/image-cri-shim/pkg/cri/cri.go @@ -223,6 +223,7 @@ func (runtime *ContainerdRuntime) RemoveContainers(containers []string) error { // don't stop on errors, try to remove as many containers as possible errs = append(errs, errors.Wrapf(err, "failed to stop running pod %s: output: %s, error", container, string(out))) } else { + // nosemgrep: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable out, err = runtime.exec.Command("crictl", "-r", runtime.criSocket, "rmp", container).CombinedOutput() if err != nil { errs = append(errs, errors.Wrapf(err, "failed to remove running container %s: output: %s, error", container, string(out))) @@ -242,6 +243,7 @@ func (runtime *DockerRuntime) RemoveContainers(containers []string) error { // don't stop on errors, try to remove as many containers as possible errs = append(errs, errors.Wrapf(err, "failed to stop running container %s: output: %s, error", container, string(out))) } else { + // nosemgrep: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable out, err = runtime.exec.Command("docker", "rm", "--volumes", container).CombinedOutput() if err != nil { errs = append(errs, errors.Wrapf(err, "failed to remove running container %s: output: %s, error", container, string(out))) diff --git a/staging/src/github.com/labring/lvscare/care/prober.go b/staging/src/github.com/labring/lvscare/care/prober.go index 8d885e48b..4fb94377f 100644 --- a/staging/src/github.com/labring/lvscare/care/prober.go +++ b/staging/src/github.com/labring/lvscare/care/prober.go @@ -72,9 +72,9 @@ func (p *httpProber) ValidateAndSetDefaults() error { func (p *httpProber) Probe(host, port string) error { if p.client == nil { - // nosemgrep p.client = &http.Client{ Transport: &http.Transport{ + // nosemgrep TLSClientConfig: &tls.Config{InsecureSkipVerify: p.InsecureSkipVerify}, }, }