Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore misconfiguration results from base image during scan #3792

Closed
Lubetkin opened this issue Mar 8, 2023 · 2 comments
Closed

Ignore misconfiguration results from base image during scan #3792

Lubetkin opened this issue Mar 8, 2023 · 2 comments
Labels
kind/feature Categorizes issue or PR as related to a new feature. lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. triage/duplicate Indicates an issue is a duplicate of other open issue.

Comments

@Lubetkin
Copy link

Lubetkin commented Mar 8, 2023

I was testing the misconfiguration scanner on an image built from ubuntu:latest and the results contain misconfiguration from the base image.
This is a similar issue found in dockle
I would like to have the option to ignore such results as you already doing this functionality in vulnerabilities results found here

Image history for base layers:

<missing>      7 days ago       /bin/sh -c #(nop)  CMD ["/bin/bash"]            0B
<missing>      7 days ago       /bin/sh -c #(nop) ADD file:fb4c8244f4468cdd3…   77.8MB
<missing>      7 days ago       /bin/sh -c #(nop)  LABEL org.opencontainers.…   0B
<missing>      7 days ago       /bin/sh -c #(nop)  LABEL org.opencontainers.…   0B
<missing>      7 days ago       /bin/sh -c #(nop)  ARG LAUNCHPAD_BUILD_ARCH     0B
<missing>      7 days ago       /bin/sh -c #(nop)  ARG RELEASE                  0B

Trivy Result:

{
  "Type": "Dockerfile Security Check",
  "ID": "DS005",
  "AVDID": "AVD-DS-0005",
  "Title": "ADD instead of COPY",
  "Description": "You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.",
  "Message": "Consider using 'COPY file:fb4c8244f4468cdd3f666932f05805a3882d34010d3a0c14b7c20589bf619a9c in /' command instead of 'ADD file:fb4c8244f4468cdd3f666932f05805a3882d34010d3a0c14b7c20589bf619a9c in /'",
  "Namespace": "builtin.dockerfile.DS005",
  "Query": "data.builtin.dockerfile.DS005.deny",
  "Resolution": "Use COPY instead of ADD",
  "Severity": "LOW",
  "PrimaryURL": "https://avd.aquasec.com/misconfig/ds005",
  "References": [
    "https://docs.docker.com/engine/reference/builder/#add",
    "https://avd.aquasec.com/misconfig/ds005"
  ],
  "Status": "FAIL",
  "Layer": {},
  "CauseMetadata": {
    "Provider": "Dockerfile",
    "Service": "general",
    "StartLine": 5,
    "EndLine": 5,
    "Code": {
      "Lines": [
        {
          "Number": 5,
          "Content": "ADD file:fb4c8244f4468cdd3f666932f05805a3882d34010d3a0c14b7c20589bf619a9c in /",
          "IsCause": true,
          "Annotation": "",
          "Truncated": false,
          "FirstCause": true,
          "LastCause": true
        }
      ]
    }
  }
}
@Lubetkin Lubetkin added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 8, 2023
@github-actions
Copy link

github-actions bot commented May 8, 2023

This issue is stale because it has been labeled with inactivity.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. label May 8, 2023
@knqyf263 knqyf263 added the triage/duplicate Indicates an issue is a duplicate of other open issue. label May 8, 2023
@knqyf263
Copy link
Collaborator

knqyf263 commented May 8, 2023

Duplicate of #3834

@knqyf263 knqyf263 marked this as a duplicate of #3834 May 8, 2023
@knqyf263 knqyf263 closed this as completed May 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature. lifecycle/stale Denotes an issue or PR has remained open with no activity and will be auto-closed. triage/duplicate Indicates an issue is a duplicate of other open issue.
Projects
None yet
Development

No branches or pull requests

2 participants