Description
I am starting a docker container with the command
docker run -it --entrypoint=/bin/bash docker.elastic.co/elasticsearch/elasticsearch:7.9.2
Then I create a requirements.txt file with:
echo "Pillow==8.3.2" > requirements.txt
The file is created in /usr/share/elasticsearch.
Then I export the running container with:
docker export relaxed_wing | tar -C /tmp/rootfs -xvf -
Then I run trivy -debug fs /tmp/rootfs and the OS unpatched packages are listed, but I would expect the requirements.txt file to be also reported. The command returns
2022-01-26T12:49:25.602+0100 DEBUG Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2022-01-26T12:49:25.605+0100 DEBUG cache dir: /home/gabriel/.cache/trivy
2022-01-26T12:49:25.605+0100 DEBUG DB update was skipped because DB is the latest
2022-01-26T12:49:25.605+0100 DEBUG DB Schema: 1, Type: 1, UpdatedAt: 2022-01-26 06:40:50.601672242 +0000 UTC, NextUpdate: 2022-01-26 12:40:50.601671542 +0000 UTC, DownloadedAt: 2022-01-26 11:41:55.537643533 +0000 UTC
2022-01-26T12:49:25.605+0100 DEBUG Vulnerability type: [os library]
2022-01-26T12:49:25.698+0100 INFO Detected OS: centos
2022-01-26T12:49:25.698+0100 INFO Detecting RHEL/CentOS vulnerabilities...
2022-01-26T12:49:25.698+0100 DEBUG redhat: os version: 7
2022-01-26T12:49:25.698+0100 DEBUG redhat: the number of packages: 152
2022-01-26T12:49:25.704+0100 INFO Number of language-specific files: 2
/tmp/rootfs (centos 7.8.2003)
=============================
Total: 876 (UNKNOWN: 0, LOW: 413, MEDIUM: 449, HIGH: 9, CRITICAL: 5)
The interesting part is that if I run trivy -debug fs /tmp/rootfs/usr, it will find the requirements.txt file, but in this case no OS issue is returned. The output is:
2022-01-26T12:50:42.755+0100 DEBUG Severities: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
2022-01-26T12:50:42.799+0100 DEBUG cache dir: /home/gabriel/.cache/trivy
2022-01-26T12:50:42.799+0100 DEBUG DB update was skipped because DB is the latest
2022-01-26T12:50:42.799+0100 DEBUG DB Schema: 1, Type: 1, UpdatedAt: 2022-01-26 06:40:50.601672242 +0000 UTC, NextUpdate: 2022-01-26 12:40:50.601671542 +0000 UTC, DownloadedAt: 2022-01-26 11:41:55.537643533 +0000 UTC
2022-01-26T12:50:42.799+0100 DEBUG Vulnerability type: [os library]
2022-01-26T12:50:42.816+0100 DEBUG OS is not detected and vulnerabilities in OS packages are not detected.
2022-01-26T12:50:42.816+0100 DEBUG Detected OS: unknown
2022-01-26T12:50:42.816+0100 INFO Number of language-specific files: 1
2022-01-26T12:50:42.816+0100 INFO Detecting pip vulnerabilities...
2022-01-26T12:50:42.816+0100 DEBUG Detecting library vulnerabilities, type: pip, path: share/elasticsearch/t/requirements.txt
share/elasticsearch/t/requirements.txt (pip)
============================================
I would expect it that when I run the first command, it will return me both OS issues and requirements.txt ones.
Output of trivy -v:
Version: 0.22.0
Vulnerability DB:
Type: Full
Version: 1
UpdatedAt: 2022-01-26 06:40:50.601672242 +0000 UTC
NextUpdate: 2022-01-26 12:40:50.601671542 +0000 UTC
DownloadedAt: 2022-01-26 11:41:55.537643533 +0000 UTC
Description
I am starting a docker container with the command
Then I create a
requirements.txtfile with:The file is created in
/usr/share/elasticsearch.Then I export the running container with:
Then I run
trivy -debug fs /tmp/rootfsand the OS unpatched packages are listed, but I would expect therequirements.txtfile to be also reported. The command returnsThe interesting part is that if I run
trivy -debug fs /tmp/rootfs/usr, it will find therequirements.txtfile, but in this case no OS issue is returned. The output is:I would expect it that when I run the first command, it will return me both OS issues and
requirements.txtones.Output of
trivy -v: