search

wiserain / docker-flexget

Docker image for running Flexget
https://hub.docker.com/r/wiserain/flexget
68 stars 40 forks source link

Docker doesn't start with CAP_DAC_OVERRIDE disabled #67

Closed ezruneko closed 2 years ago

ezruneko commented 2 years ago

The docker does not start with CAP_DAC_OVERRIDE disabled. this is a potential entry point for an attacker.

-------------------------------------
          _         ()
         | |  ___   _    __
         | | / __| | |  /  \
         | | \__ \ | | | () |
         |_| |___/ |_|  \__/
Brought to you by linuxserver.io
-------------------------------------
To support LSIO projects visit:
https://www.linuxserver.io/donate/
-------------------------------------
GID/UID
-------------------------------------
User uid:    1009
User gid:    1001
-------------------------------------
[cont-init.d] 10-adduser: exited 0.
[cont-init.d] 15-install-pkg: executing... 
[cont-init.d] 15-install-pkg: exited 0.
[cont-init.d] 20-config: executing... 
*** Using existing config.yml
*** Setting flexget web password
Could not start manager: [Errno 13] Permission denied: '/config/flexget.log'
[cont-init.d] 20-config: exited 1.
[cont-finish.d] executing container finish scripts...
[cont-finish.d] done.
[s6-finish] waiting for services.
[s6-finish] sending all processes the TERM signal.

More info: https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities#cap_dac_override

Thank you