Permission denied error while trying to generate html report from Docker

ShockwaveNN commented 3 years ago

Background

Brakeman version: 5.0.0 Rails version: 6.1.1 Ruby version: ??? provided by default docker

Link to Rails application code: https://github.com/ONLYOFFICE/testing-wrata/ But I think project is not related

Issue

Run brakeman in docker with html report as said in README.md

docker run -v "$(pwd)":/code presidentbeef/brakeman -o brakeman_results.html

brakeman is running, but resulting error on report finalization:

Generating report...
/usr/src/app/lib/brakeman.rb:414:in `initialize': Permission denied @ rb_sysopen - brakeman_results.html (Errno::EACCES)
        from /usr/src/app/lib/brakeman.rb:414:in `open'
        from /usr/src/app/lib/brakeman.rb:414:in `block in write_report_to_files'
        from /usr/src/app/lib/brakeman.rb:408:in `each'
        from /usr/src/app/lib/brakeman.rb:408:in `each_with_index'
        from /usr/src/app/lib/brakeman.rb:408:in `write_report_to_files'
        from /usr/src/app/lib/brakeman.rb:394:in `scan'
        from /usr/src/app/lib/brakeman.rb:85:in `run'
        from /usr/src/app/lib/brakeman/commandline.rb:157:in `run_brakeman'
        from /usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
        from /usr/src/app/lib/brakeman/commandline.rb:166:in `run_report'
        from /usr/src/app/lib/brakeman/commandline.rb:35:in `run'
        from /usr/src/app/lib/brakeman/commandline.rb:20:in `start'
        from /usr/src/app/bin/brakeman:10:in `<main>'

Seems like some kind of permission issue, I can provide some more info, but there is no strange permission applied to my current working directory

Other Error

Run Brakeman with --debug to see the full stack trace.

Cannot do in Docker

carlosjpr-collab commented 3 years ago

I see the same pb

jympetalmd commented 3 years ago

Looks like a permissions problem. The user in the docker container is app (UID: 9000) so file mounted with a volume should be accessible for this user. Since the file mounted are propably owned by you or root (in the case of my jenkins), you need to mount a new 'open world' volume writable by anyone, like most /tmp:

docker run \ -v "$(pwd)":/code:ro \ -v /tmp:/tmp \ presidentbeef/brakeman \ -o /tmp/brakeman_results.html

ShockwaveNN commented 3 years ago

@jympetalmd Nope, sorry, your variant (with adding \ to break lines) still does not work for me with the same error

docker run \
-v "$(pwd)":/code:ro \
-v /tmp:/tmp \
presidentbeef/brakeman \
-o brakeman_results.html
....
/usr/src/app/lib/brakeman.rb:427:in `initialize': Read-only file system @ rb_sysopen - brakeman_results.html (Errno::EROFS)
    from /usr/src/app/lib/brakeman.rb:427:in `open'
    from /usr/src/app/lib/brakeman.rb:427:in `block in write_report_to_files'
    from /usr/src/app/lib/brakeman.rb:421:in `each'
    from /usr/src/app/lib/brakeman.rb:421:in `each_with_index'
    from /usr/src/app/lib/brakeman.rb:421:in `write_report_to_files'
    from /usr/src/app/lib/brakeman.rb:407:in `scan'
    from /usr/src/app/lib/brakeman.rb:86:in `run'
    from /usr/src/app/lib/brakeman/commandline.rb:157:in `run_brakeman'
    from /usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
    from /usr/src/app/lib/brakeman/commandline.rb:166:in `run_report'
    from /usr/src/app/lib/brakeman/commandline.rb:35:in `run'
    from /usr/src/app/lib/brakeman/commandline.rb:20:in `start'
    from /usr/src/app/bin/brakeman:10:in `<main>'

jympetalmd commented 3 years ago

@jympetalmd Nope, sorry, your variant (with adding \ to break lines) still does not work for me with the same error

docker run \
-v "$(pwd)":/code:ro \
-v /tmp:/tmp \
presidentbeef/brakeman \
-o brakeman_results.html
....
/usr/src/app/lib/brakeman.rb:427:in `initialize': Read-only file system @ rb_sysopen - brakeman_results.html (Errno::EROFS)
  from /usr/src/app/lib/brakeman.rb:427:in `open'
  from /usr/src/app/lib/brakeman.rb:427:in `block in write_report_to_files'
  from /usr/src/app/lib/brakeman.rb:421:in `each'
  from /usr/src/app/lib/brakeman.rb:421:in `each_with_index'
  from /usr/src/app/lib/brakeman.rb:421:in `write_report_to_files'
  from /usr/src/app/lib/brakeman.rb:407:in `scan'
  from /usr/src/app/lib/brakeman.rb:86:in `run'
  from /usr/src/app/lib/brakeman/commandline.rb:157:in `run_brakeman'
  from /usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
  from /usr/src/app/lib/brakeman/commandline.rb:166:in `run_report'
  from /usr/src/app/lib/brakeman/commandline.rb:35:in `run'
  from /usr/src/app/lib/brakeman/commandline.rb:20:in `start'
  from /usr/src/app/bin/brakeman:10:in `<main>'

Sorry forgot to add /tmp to the -o output path: -o /tmp/brakeman_results.html

ShockwaveNN commented 3 years ago

docker run \
-v "$(pwd)":/code:ro \
-v /tmp:/tmp \
presidentbeef/brakeman \
-o /tmp/brakeman_results.html

Yep this variant works. I think we should fix readme, I can create PR or @jympetalmd you can do it?

jympetalmd commented 3 years ago

docker run \
-v "$(pwd)":/code:ro \
-v /tmp:/tmp \
presidentbeef/brakeman \
-o /tmp/brakeman_results.html
Yep this variant works. I think we should fix readme, I can create PR or @jympetalmd you can do it?

Done: https://github.com/presidentbeef/brakeman/pull/1644

presidentbeef / brakeman