search

freedomofpress / containers

Repo to house all FPF related containers
4 stars 1 forks source link

Investigate vuln scans #23

Open maeve-fpf opened 4 years ago

maeve-fpf commented 4 years ago

Here's the scan Quay ran on the latest CI-built image for gke-gs-bucket-backup from this repo: https://quay.io/repository/freedomofpress/gke-gs-bucket-backup/manifest/sha256:b28507c41e51ae64bb95d13e89a5c502061eb0a99043e76bdd3b47de038fdb90?tab=vulnerabilities (that's tag master_680c45a). There's a lot there! You can check the packages in the container with:

docker run --entrypoint /bin/sh quay.io/freedomofpress/gke-gs-bucket-backup:master_680c45a -c 'dpkg -l' | less

And you can see that the critical warnings for linux is because linux-libc-dev, the kernel headers which are built from the linux source package, are installed. Obviously a kernel is not installed.

So, let's research how to make these scans more useful - it sounds like this is probably an issue many Quay users have encountered and may have solutions for.

conorsch commented 4 years ago

Having trouble loading any of the scans right now:

quay-security-scans-not-loading

Based on prior output I've seen, there's definitely a ton of noise in those scan reports. Granted, we took a while to update our images, but I've also seen quay complaining about old package versions without taking into account backported security fixes, e.g. from Canonical for ubuntu images. Looks like Quay runs "Clair" to handle the scanning:

So optimistic that we could learn more about how folks manage these alerts.