Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set #151

Open
sbarillet opened this issue Jun 1, 2020 · 1 comment
Open

Comments

@sbarillet
Copy link

Hello,
I try to slim one of my container based on UBUNTU:18.04,
I've a x30 minify performance that is really great but I've a sudo command issue which I can't get rid of.
In my Dockerfile, I've an 'apt-get install sudo' command in a bash script called by the ENTRYPOINT
and I need it to load a driver at container start-up due to a USER switch.
The bash file contains this line: sudo /etc/init.d/<cmd> start
When I check the docker logs stdout, I've the following issue:
sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set
I tried to escalade the issue, using docker exec command in root mode, and I checked the file permission that should be 4755.
docker exec --user root -it 01 bash
bash-4.4# stat -c "%a" /usr/bin/sudo
755
In the container execution (docker exec --user root -it bash), I was able to change the sudo file permission (chmod 4755 /usr/bin/sudo) and after that, if I re execute the container the current user, I was able to execute the sudo command.
So, I think that my issue is related to a file permission.

Here is the docker-slim build command I used, but It doesn't fix the sudo permission issue:

docker-slim build --include-shell \ --include-exe='/bin/chmod' \ --include-exe='/bin/chown' \ --include-exe='/usr/bin/stat' \ --include-path='/usr/bin/sudo:4755' \ --include-path='/usr/lib' \ --include-path='/usr/tmp' \ --include-path='/var/tmp' \ my_container:ubuntu

I've also tried with others switch such as --path-perms-file='/usr/bin/sudo:4755' but with no luck.
Any idea to apply to resolve this issue ? Thanks.

@kcq
Copy link
Member

kcq commented Jun 17, 2020

@xlz-sbarillet might be good to try setting the user (and potentially group) ID on /usr/bin/sudo to 0 like this: --include-path='/usr/bin/sudo:4755#0#0' You can find a bit more about it here: https://github.com/docker-slim/docker-slim#what-if-my-docker-images-uses-the-user-command

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants