fix: use the non-root atlantis user instead of root #3886

bschaatsbergen · 2023-10-21T01:34:52Z

what

Make standard use of the atlantis user and not root.
Removed gosu, as we're using the atlantis user anyways
Set DOCKER_CONTENT_TRUST=1 anywhere we build

why

gosu has various security issues reported (see reported issues)
it's not a good practice to use the root user by default

tests

references

Closes Run docker container as atlantis instead of root #3777
Partially fixes Fix dockle container security issues #3789

bschaatsbergen · 2023-10-21T01:36:33Z

TODO: needs testing locally

bschaatsbergen · 2023-10-21T01:58:57Z

@nitrocode, @GenPage, @jamengual if you have some time later this week - I consider this quite an impactful change and it would require thorough testing before shipping it.

Dockerfile

nitrocode · 2023-10-21T04:29:41Z

@bschaatsbergen I see the tests pass which is great but it would be nice to test this out in your setup and verify the following

atlantis project autodiscovery
atlantis website for locks and plans
atlantis init/plan/apply workflow
atlantis downloading terraform binaries
anything else that uses local storage?

nitrocode · 2023-10-21T04:30:49Z

One thing I'm curious about is why there do not need to be any chmod or chown changes as part of this pr?

bschaatsbergen · 2023-10-21T10:36:35Z

One thing I'm curious about is why there do not need to be any chmod or chown changes as part of this pr?

Yes, I think we do - as we've removed the line adduser atlantis root the chmod g=u ... would be useless, as the atlantis user is no longer in the root group. I'll work on this too.

nitrocode · 2023-10-21T19:20:23Z

Thanks @bschaatsbergen. Please also rerun dockle and show the output in the pr summary. If we can reduce that to zero and still have atlantis running as usual then that would fully close our the associated issue.

…lege escalation and improve comments

bschaatsbergen · 2023-10-21T21:24:49Z

@bschaatsbergen I see the tests pass which is great but it would be nice to test this out in your setup and verify the following

atlantis project autodiscovery

atlantis website for locks and plans

atlantis init/plan/apply workflow

atlantis downloading terraform binaries

anything else that uses local storage?

Tested:

✅ atlantis website for locks and plans
✅ atlantis init/plan/apply workflow
✅ atlantis downloading terraform binaries
✅ cloning of the git repository
✅ being able to mount a persistent data disk and use that as atlantis' home directory
✅ writing to local storage using Terraform

bschaatsbergen · 2023-10-21T21:56:20Z

dockle seems to be happy overall, note solving CIS-DI-0008 is quite hard and as it's an info level check I think that we can skip it and address it in the nearby future if it ever posses a problem?

$ dockle ghcr.io/bschaatsbergen/atlantis:dev-alpine-2d7ba9e
$ dockle ghcr.io/bschaatsbergen/atlantis:dev-debian-2d7ba9e
INFO - CIS-DI-0008: Confirm safety of setuid/setgid files

setuid file: urwxr-xr-x usr/bin/mount

setuid file: urwxr-xr-x usr/lib/openssh/ssh-keysign

setuid file: urwxr-xr-x usr/bin/newgrp

setuid file: urwxr-xr-x usr/bin/chfn

setgid file: grwxr-xr-x usr/bin/ssh-agent

setgid file: grwxr-xr-x usr/sbin/unix_chkpwd

setuid file: urwxr-xr-x usr/bin/passwd

setuid file: urwxr-xr-x usr/bin/gpasswd

setuid file: urwxr-xr-x usr/bin/su

setuid file: urwxr-xr-x usr/bin/umount

setgid file: grwxr-xr-x usr/bin/wall

setgid file: grwxr-xr-x usr/bin/expiry

setgid file: grwxr-xr-x usr/bin/chage

setuid file: urwxr-xr-x usr/bin/chsh

bschaatsbergen · 2023-10-21T22:47:37Z

This is ready for review @nitrocode, @jamengual, @GenPage - I've extensively tested the alpine image (besides autodiscovery) and I'm unable to test out the debian image - if one of you could check the debian image out that would be appreciated.

I've published both an alpine as well as a debian image:

ghcr.io/bschaatsbergen/atlantis:dev-alpine-2d7ba9e
ghcr.io/bschaatsbergen/atlantis:dev-debian-2d7ba9e

Dockerfile

.github/workflows/testing-env-image.yml

nitrocode · 2023-10-23T12:10:23Z

Dockerfile

-    chmod g=u /home/atlantis/ && \
-    chmod g=u /etc/passwd
+    chmod u+rwx /home/atlantis/ && \
+    chmod u+rw /etc/passwd



How come the chmod of /etc/passwd needs to change? If the line is removed, can atlantis still function?

the previous chmod g=u sets the group permissions for the /home/atlantis/ directory to be the same as the user's permissions.

The new chmod sets the user's permissions for the /home/atlantis/ directory to read, write (and execute).

So, the change here is that the original command was changing group permissions to match user permissions, and it has been modified to give the user explicit permissions instead.

Right but I don't understand why /etc/passwd perms need to be changed. Can we get away with only changing /home/atlantis ?

Ah, I didn't want to break anything. Therefor I just gave it read write permissions. We can't use g=u anymore though.

Ok no worries then, can always tackle it later. Thank you!

Ok but the more changes made, the more likely something can break. I'm all for more security, provided @bschaatsbergen has the appetite to keep going 🙏

Is this really the case? I'm happy to add it, but couldn't find it anywhere. I know that users start from 1000 though. Is there a particular reason we should explicitly set this? Omitting it would prevent a uid and gid conflict right? @jamengual

I've set uid/gid 100:1000 and removed the passwd entry lines.

alpine and debian have different uid's it appears: #3317 (comment)
alpine: uid=100, debian: uid=1000

@arohter it's removed again, to stay inline with what's in the Dockerfile now. to avoid touching the uid and gid at all.

Dockerfile

GenPage

Approved, all of my concerns were already addressed. Is there anything left to do @bschaatsbergen based on your last comment?

bschaatsbergen · 2023-11-04T07:15:10Z

Approved, all of my concerns were already addressed. Is there anything left to do @bschaatsbergen based on your last comment?

there is one more comment to resolve, which is about the passwd file changes.

Fixing this today, been a hectic week!

jamengual · 2023-11-08T20:26:25Z

/cherry-pick release-0.26

* feat: use Atlantis user by default and get rid of gosu * chore: set `DOCKER_CONTENT_TRUST=1` * chore: fix chmod and chown * feat: add a healthcheck to the debian and alpine images * feat: removing setuid and setgid permissions prevents container privilege escalation and improve comments * chore: remove setgid/setuid as we chown an entire directory * chore: keep deps comment generic * chore: grammar * chore: remove redundant comment * chore: rm DOCKER_CONTENT_TRUST * chore: set uid and gid and remove passwd entry * chore: revert gid and uid set as it's conflicting --------- Co-authored-by: PePe Amengual <jose.amengual@gmail.com>

* feat: use Atlantis user by default and get rid of gosu * chore: set `DOCKER_CONTENT_TRUST=1` * chore: fix chmod and chown * feat: add a healthcheck to the debian and alpine images * feat: removing setuid and setgid permissions prevents container privilege escalation and improve comments * chore: remove setgid/setuid as we chown an entire directory * chore: keep deps comment generic * chore: grammar * chore: remove redundant comment * chore: rm DOCKER_CONTENT_TRUST * chore: set uid and gid and remove passwd entry * chore: revert gid and uid set as it's conflicting --------- Co-authored-by: Bruno Schaatsbergen <58337159+bschaatsbergen@users.noreply.github.com>

Alex-Mussell · 2023-12-13T15:40:44Z

Asked to comment: https://atlantis-community.slack.com/archives/C5MGGAV0C/p1702475459555389 here as there probably needs to be some documentation in the release notes regarding this update. But here is the lowdown.

We use the Atlantis image as a base image and added some extra functionality to the container like so:

BEFORE:

FROM ghcr.io/runatlantis/atlantis:v0.27.0-alpine
RUN apk add --no-cache python3 python3-dev py3-pip libc-dev libffi-dev gcc jq yq
RUN pip3 install --upgrade pip
RUN pip3 install --no-cache-dir \
  'msal==1.4.3' \
  'awscli'

etc.etc.

And this worked fine prior to v0.27.0. However we started to get an error: #8 0.951 ERROR: Unable to lock database: Permission denied , having looked around I resolved this by then doing the following (notice how I also had to create a virtualenv to be able to upgrade pip once the above error was resolved):

AFTER:

FROM ghcr.io/runatlantis/atlantis:v0.27.0-alpine
USER root   <------ ADDED

ENV VIRTUAL_ENV=/opt/venv
RUN apk add --no-cache python3 python3-dev py3-pip libc-dev libffi-dev gcc jq yq
RUN python3 -m venv $VIRTUAL_ENV
## We can replace source <venv>/activate by setting the appropriate environment variables: Docker's ENV command applies both subsequent RUNs as well as to the CMD.
ENV PATH="$VIRTUAL_ENV/bin:$PATH"
RUN pip3 install --upgrade pip
RUN pip3 install --no-cache-dir \
  'msal==1.4.3' \
  'awscli'

etc.etc.

USER atlantis   <----- ADDED

Next we deploy this container via Ansible onto an EC2 instance, but there needed to be some changes in some tasks as we are now the atlantis user. Any time a task that requires you to be root within the container on the host, you now need to explicitly define the root user as the executor of the task. For example, we have an AWS config that needs to be readable by the atlantis user.

BEFORE:
- name: Make AWS conf readable by Atlantis
  community.docker.docker_container_exec:
    container: atlantis
    command: /bin/bash -c "chown atlantis:atlantis /home/atlantis/.aws/"

AFTER:
- name: Make AWS conf readable by Atlantis
  community.docker.docker_container_exec:
    user: root
    container: atlantis
    command: /bin/bash -c "chown atlantis:atlantis /home/atlantis/.aws/"

* feat: use Atlantis user by default and get rid of gosu * chore: set `DOCKER_CONTENT_TRUST=1` * chore: fix chmod and chown * feat: add a healthcheck to the debian and alpine images * feat: removing setuid and setgid permissions prevents container privilege escalation and improve comments * chore: remove setgid/setuid as we chown an entire directory * chore: keep deps comment generic * chore: grammar * chore: remove redundant comment * chore: rm DOCKER_CONTENT_TRUST * chore: set uid and gid and remove passwd entry * chore: revert gid and uid set as it's conflicting --------- Co-authored-by: PePe Amengual <jose.amengual@gmail.com>

feat: use Atlantis user by default and get rid of gosu

d0b5c16

bschaatsbergen changed the title ~~feat: use Atlantis user by default and get rid of gosu (as per vulns)~~ address Docker container security issues Oct 21, 2023

bschaatsbergen changed the title ~~address Docker container security issues~~ fix: address Docker container security issues Oct 21, 2023

bschaatsbergen mentioned this pull request Oct 21, 2023

Fix dockle container security issues #3789

Closed

chore: set DOCKER_CONTENT_TRUST=1

be9a8d3

bschaatsbergen marked this pull request as ready for review October 21, 2023 01:57

bschaatsbergen requested a review from a team as a code owner October 21, 2023 01:57

github-actions bot added build Relating to how we build Atlantis github-actions labels Oct 21, 2023

jamengual reviewed Oct 21, 2023

View reviewed changes

Dockerfile Show resolved Hide resolved

Dockerfile Show resolved Hide resolved

chore: fix chmod and chown

da4d186

bschaatsbergen added 3 commits October 21, 2023 22:58

feat: add a healthcheck to the debian and alpine images

a9605b8

feat: removing setuid and setgid permissions prevents container privi…

ef609e5

…lege escalation and improve comments

chore: remove setgid/setuid as we chown an entire directory

4c6068f

nitrocode reviewed Oct 22, 2023

View reviewed changes

Dockerfile Show resolved Hide resolved

Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu

6910d25

nitrocode reviewed Oct 23, 2023

View reviewed changes

.github/workflows/testing-env-image.yml Outdated Show resolved Hide resolved

nitrocode reviewed Oct 23, 2023

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

nitrocode reviewed Oct 23, 2023

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

nitrocode reviewed Oct 23, 2023

View reviewed changes

Dockerfile Show resolved Hide resolved

GenPage added the waiting-on-response Waiting for a response from the user label Nov 4, 2023

GenPage previously approved these changes Nov 4, 2023

View reviewed changes

This comment was marked as resolved.

Sign in to view

chore: set uid and gid and remove passwd entry

378b857

bschaatsbergen dismissed stale reviews from GenPage and nitrocode via 378b857 November 4, 2023 19:36

bschaatsbergen and others added 4 commits November 4, 2023 20:37

Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu

cdef470

chore: revert gid and uid set as it's conflicting

0029249

Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu

fd89c0b

Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu

0767f62

jamengual approved these changes Nov 7, 2023

View reviewed changes

nitrocode approved these changes Nov 7, 2023

View reviewed changes

Merge branch 'main' into docker-use-atlantis-user-and-remove-gosu

c0bf56c

jamengual merged commit e9c0d72 into runatlantis:main Nov 9, 2023
23 checks passed

nitrocode mentioned this pull request Nov 9, 2023

fix: use the non-root atlantis user instead of root (cherry-pick #3886) #3964

Merged

bschaatsbergen deleted the docker-use-atlantis-user-and-remove-gosu branch November 14, 2023 09:37

nitrocode added the bug Something isn't working label Dec 11, 2023

BrewTestBot mentioned this pull request Dec 12, 2023

atlantis 0.27.0 Homebrew/homebrew-core#157029

Merged

jamengual mentioned this pull request Dec 13, 2023

docs: Custom container doc update #4054

Merged

medwards1771 mentioned this pull request Jan 4, 2024

Error running curl -O -L <path-to-remote-file> from atlantis:v0.27.0 Docker image #4119

Closed

BrewTestBot mentioned this pull request May 22, 2024

atlantis 0.28.0 Homebrew/homebrew-core#172542

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: use the non-root atlantis user instead of root #3886

fix: use the non-root atlantis user instead of root #3886

bschaatsbergen commented Oct 21, 2023 •

edited by nitrocode

Loading

bschaatsbergen commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023

nitrocode commented Oct 21, 2023

nitrocode commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023

nitrocode commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023 •

edited

Loading

bschaatsbergen commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023

nitrocode Oct 23, 2023

bschaatsbergen Oct 23, 2023 •

edited

Loading

nitrocode Oct 23, 2023

bschaatsbergen Oct 23, 2023

nitrocode Oct 23, 2023

nitrocode Oct 25, 2023

bschaatsbergen Nov 4, 2023

bschaatsbergen Nov 4, 2023

arohter Nov 7, 2023 •

edited

Loading

bschaatsbergen Nov 8, 2023

GenPage left a comment

This comment was marked as resolved.

bschaatsbergen commented Nov 4, 2023

jamengual commented Nov 8, 2023

Alex-Mussell commented Dec 13, 2023

fix: use the non-root atlantis user instead of root #3886

fix: use the non-root atlantis user instead of root #3886

Conversation

bschaatsbergen commented Oct 21, 2023 • edited by nitrocode Loading

what

why

tests

references

bschaatsbergen commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023

nitrocode commented Oct 21, 2023

nitrocode commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023

nitrocode commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023 • edited Loading

bschaatsbergen commented Oct 21, 2023

bschaatsbergen commented Oct 21, 2023

Choose a reason for hiding this comment

bschaatsbergen Oct 23, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

arohter Nov 7, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GenPage left a comment

Choose a reason for hiding this comment

This comment was marked as resolved.

bschaatsbergen commented Nov 4, 2023

jamengual commented Nov 8, 2023

Alex-Mussell commented Dec 13, 2023

bschaatsbergen commented Oct 21, 2023 •

edited by nitrocode

Loading

bschaatsbergen commented Oct 21, 2023 •

edited

Loading

bschaatsbergen Oct 23, 2023 •

edited

Loading

arohter Nov 7, 2023 •

edited

Loading