[bitnami/kafka] /usr/sbin has Owner and Group Writable permissions

[pushkargr]

Name and Version

bitnami/kafka:3.6.1-debian-11-r0

What architecture are you using?

amd64

What steps will reproduce the bug?

Run the following command,
docker run --rm --entrypoint=bash docker.io/bitnami/kafka:3.6.1-debian-11-r0 -c "ls -lrt /usr"

What is the expected behavior?

/usr/sbin file should not be writable as it contains binaries which are
frequently executed by the system with high privileges. A malicious user can
modify the binaries in /usr/sbin and run malicious code/command with root
privileges.

What do you see instead?

sbin directory has drwxrwxr-x permission

total 36
drwxr-xr-x  3 root root 4096 Sep 24  2020 libexec
drwxr-xr-x  2 root root 4096 Apr 18  2023 src
drwxr-xr-x  2 root root 4096 Apr 18  2023 include
drwxr-xr-x  2 root root 4096 Apr 18  2023 games
drwxr-xr-x 10 root root 4096 Dec  9 09:53 local
drwxr-xr-x 35 root root 4096 Dec  9 09:53 share
drwxrwxr-x  2 root root 4096 Dec  9 09:53 sbin
drwxr-xr-x 12 root root 4096 Dec  9 09:53 lib
drwxr-xr-x  2 root root 4096 Dec  9 09:53 bin

Additional information

No response

[jotamartos]

Hi @pushkargr,

Thank you for taking the time to create this support ticket. Due to security reasons, the Bitnami Kafka container is a non-root container and that brings several improvements

https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-why-non-root-containers-are-important-for-security-index.html

Please note that if a malicious user/process gets root privileges, it can also modify the permissions of the whole file system and perform any action. However, if you think that the security of the container can be improved, you can follow our contributing guidelines and propose any change you find relevant.

Thanks

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.