Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
/usr/local/bin/grpcurl
is installed with UID/GID of708061865
/708061865
:80c75558f0a4 ~ stat /usr/local/bin/grpcurl File: /usr/local/bin/grpcurl Size: 24027136 Blocks: 46936 IO Block: 4096 regular file Device: 6ah/106d Inode: 33873716 Links: 1 Access: (0755/-rwxr-xr-x) Uid: (708061865/ UNKNOWN) Gid: (708061865/ UNKNOWN) Access: 2023-10-24 17:14:57.000000000 +0000 Modify: 2023-10-24 17:14:57.000000000 +0000 Change: 2024-02-16 17:40:28.913486261 +0000
as reported in issue #157.
This appears to be the result of the contents of the upstream tarball.
A quick look shows that every other binary in
/usr/bin
,/usr/sbin
, and/usr/local/bin
have a UID/GID of0
/0
, except for/usr/local/bin/termshark
which is1000
/1000
(and/usr/bin/wall
group oftty
, which we can ignore). I felt reasonably confident that settinggrpcurl
to0
/0
would be acceptable in this scenario.The likely preferable approach would be to get this corrected in the upstream repo: https://github.com/fullstorydev/grpcurl
Fix
chown
to enforce UID/GID ofroot
/root
Trivial smoke test
Build new image and run it, then: