Address Dockle finding

Enterprise-CMCS · Dec 12, 2024 · c3b49f2 · c3b49f2
1 parent aeec236
commit c3b49f2
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/latest.Dockerfile b/latest.Dockerfile
@@ -42,6 +42,10 @@ RUN apt-get update \
     unzip \
     && rm -rf /var/lib/apt/lists
 
+# Remove setuid and setgid permissions after all package installations to addresss
+# https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#cis-di-0008
+RUN find / -path /proc -prune -o -perm /6000 -type f -exec chmod a-s {} + || true
+
 WORKDIR /home/runner
 USER runner