How to make Ubuntu keep sudo? #302

ProfessorManhattan · 2022-03-22T04:59:08Z

ProfessorManhattan
Mar 22, 2022

Hey, I've been getting bugged by this error:

sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set

So, I reduced the container to this:

FROM ubuntu:focal

RUN apt-get update \
  && apt-get install -y \
  sudo

How can I make it so that I can run sudo bash with an --exec?

kcq · 2022-03-22T06:46:32Z

kcq
Mar 22, 2022
Maintainer

@ProfessorManhattan what's your command line for docker-slim when you are minifying? Is sudo there, but the file metadata is not correct?

Normally you'd use --include-bin, --include-exe or --include-path flags. With --include-path you'll need to include all shared libraries used by sudo too. --include-exe allows you to use just the executable name (eg --include-exe=sudo) and with --include-bin you'll need to use the full path to the executable (eg --include-bin=/your/path/to/sudo)

0 replies

ProfessorManhattan · 2022-03-23T04:39:16Z

ProfessorManhattan
Mar 23, 2022
Author

Hey @kcq -- thanks for the help, it's awesome that you're able to always help the community and publish sick software.

I managed to get past the minimal example, but I'm still having an issue whenever I change the user and try to build. I'm getting the /usr/bin/sudo issue when I use this code:

FROM ubuntu:focal AS updater

ENV APP_USER=megabyte
ENV container=docker
ENV DEBIAN_FRONTEND=noninteractive
ENV NO_INSTALL_HOMEBREW=true
ENV NO_INSTALL_POETRY=true

WORKDIR /work

COPY local/initctl ./
COPY bin/ /usr/local/bin/

SHELL ["/bin/bash", "-eo", "pipefail", "-c"]
# hadolint ignore=DL3008
RUN chmod +x /usr/local/bin/* \
  && apt-get update \
  && apt-get install -y \
  build-essential=12.* \
  ca-certificates=* \
  curl=7.* \
  expect=5.* \
  file=* \
  g++=* \
  gawk=* \
  gcc=* \
  git=* \
  jq=1.* \
  libimage-exiftool-perl=11.* \
  make=4.* \
  procps=* \
  rsync=3.* \
  software-properties-common=0.* \
  ssh-client \
  sudo \
  && add-apt-repository -y ppa:deadsnakes/ppa \
  && curl -sL https://deb.nodesource.com/setup_16.x -o /tmp/node_setup.sh \
  && bash /tmp/node_setup.sh \
  && rm /tmp/node_setup.sh \
  && curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | tee /usr/share/keyrings/yarnkey.gpg >/dev/null \
  && echo "deb [signed-by=/usr/share/keyrings/yarnkey.gpg] https://dl.yarnpkg.com/debian stable main" | tee /etc/apt/sources.list.d/yarn.list \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
  nodejs=16.* \
  python3.10=* \
  python3-pip=20.* \
  yarn=1.* \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/* \
  && rm -rf /usr/share/doc /usr/share/man /tmp/* /var/tmp/* \
  && useradd -m -s "$(which bash)" "${APP_USER}" \
  && echo "${APP_USER}"' ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers \
  && chown -R "${APP_USER}:${APP_USER}" ./

WORKDIR /home/megabyte

USER megabyte

With this build command:

docker build --build-arg BUILD_DATE=2022-03-21T23:52:29-04:00 --build-arg REVISION=316a5d3caf0e1baf1c1b7f717991f9ea038af6fd --build-arg VERSION=1.0.0 --tag megabytelabs/updater:latest  --target updater .

With this slim command:

docker-slim build --tag megabytelabs/updater:slim  --http-probe=false --exec "sudo -n true" --include-exe-file "local/exe.txt" megabytelabs/updater:latest

And here's the exe.txt file:

bash
bin
brew
curl
docker
docker-compose
esbuild
eslint
exiftool
hbs
gawk
gh
git
glab
go
goreleaser
jq
leasot
liquidjs
make
nfpm
node
npm
poetry
pnpm
prettier
python
python3
python3.10
readme
remark
rsync
snapcraft
ssh
sshpass
sudo
task
whoami
yq

And here's the paths.txt file:

/usr/local/bin
/usr/lib/node_modules
/usr/pnpm-global
/home/linuxbrew/.linuxbrew
/etc/sudoers

0 replies

ProfessorManhattan · 2022-03-23T04:59:06Z

ProfessorManhattan
Mar 23, 2022
Author

I removed all the unused paths and exes and ran the build again with the same command except I added the clogs/blogs:

docker-slim build --tag megabytelabs/updater:slim  --http-probe=false --exec "sudo -n true" --include-exe-file "local/exe.txt" --include-path-file "local/paths.txt" --show-clogs --show-blogs megabytelabs/updater:latest
docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'
cmd=build info=exec message='changing continue-after from probe to nothing because http-probe is disabled' 
cmd=build info=exec message='updating continue-after mode to exec' 
cmd=build state=started
cmd=build info=params target.type='image' target='megabytelabs/updater:latest' continue.mode='exec' rt.as.user='true' keep.perms='true' tags='megabytelabs/updater:slim' 
cmd=build state=image.inspection.start
cmd=build info=image id='sha256:9aebaaa664976b75cc908b0b3c3a811b9e36e30fff9bf74a77475bad922a6efa' size.bytes='816034104' size.human='816 MB' 
cmd=build info=image.stack index='0' name='ubuntu:focal' id='sha256:ff0fea8310f3957d9b1e6ba494f3e4b63cb348c76160c6c15578e65995ffaa87' 
cmd=build info=image.stack index='1' name='megabytelabs/updater:latest' id='sha256:9aebaaa664976b75cc908b0b3c3a811b9e36e30fff9bf74a77475bad922a6efa' 
cmd=build state=image.inspection.done
cmd=build state=container.inspection.start
cmd=build info=container name='dockerslimk_588250_20220323045556' id='511ccb15fbd762b7639fbf0ebbc26fc678e2d86bc91cad9b687b3289b1fc0271' status='created' 
cmd=build info=cmd.startmonitor status='sent' 
cmd=build info=event.startmonitor.done status='received' 
cmd=build info=container name='dockerslimk_588250_20220323045556' id='511ccb15fbd762b7639fbf0ebbc26fc678e2d86bc91cad9b687b3289b1fc0271' target.port.list='' target.port.info='' message='YOU CAN USE THESE PORTS TO INTERACT WITH THE CONTAINER' 
cmd=build info=continue.after mode='exec' message='provide the expected input to allow the container inspector to continue its execution' 
cmd=build info=continue.after mode='exec' shell='sudo -n true' 
cmd=build info=continue.after mode='exec' exitcode='0' 
cmd=build state=container.inspection.finishing
docker-slim: container stdout:
docker-slim: container stderr:
time="2022-03-23T04:55:56Z" level=info msg="sensor: args => []string{\"/opt/dockerslim/bin/docker-slim-sensor\"}"
time="2022-03-23T04:55:56Z" level=info msg="sensor: waiting for commands..."
time="2022-03-23T04:55:56Z" level=info msg="sensor: monitor starting..."
time="2022-03-23T04:55:56Z" level=info msg="fanmon: Run"
time="2022-03-23T04:55:56Z" level=info msg="ptmon: Run"
time="2022-03-23T04:55:59Z" level=info msg="sensor: waiting for monitor to complete startup..."
time="2022-03-23T04:55:59Z" level=info msg="sensor: monitor started (true)..."
time="2022-03-23T04:56:00Z" level=info msg="sensor: 'stop' monitor command"
time="2022-03-23T04:56:00Z" level=info msg="sensor: waiting for monitor to finish..."
time="2022-03-23T04:56:00Z" level=info msg="fanmon: processor - stopping..."
time="2022-03-23T04:56:00Z" level=warning msg="findSymlinks.checkPathSymlinks - error evaluating symlink (lstat /etc/modules: no such file or directory) -> /etc/modules-load.d/modules.conf => /etc/modules"
time="2022-03-23T04:56:00Z" level=info msg="findSymlinks - could not get target stats info for file (stat /etc/modules-load.d/modules.conf: no such file or directory) -> /etc/modules-load.d/modules.conf"
time="2022-03-23T04:56:00Z" level=info msg="fanmon: collector - stopping...."
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libtinfo.so.6,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libtinfo.so.6) error: symlink libtinfo.so.6.2 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libtinfo.so.6: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libdl.so.2,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libdl.so.2) error: symlink libdl-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libdl.so.2: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libc.so.6,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6) error: symlink libc-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libpam.so.0,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpam.so.0) error: symlink libpam.so.0.84.2 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpam.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libpam_misc.so.0,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpam_misc.so.0) error: symlink libpam_misc.so.0.82.1 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpam_misc.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libutil.so.1,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libutil.so.1) error: symlink libutil-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libutil.so.1: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libc.so.6,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6) error: symlink libc-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libaudit.so.1,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libaudit.so.1) error: symlink libaudit.so.1.0.0 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libaudit.so.1: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libdl.so.2,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libdl.so.2) error: symlink libdl-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libdl.so.2: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib64/ld-linux-x86-64.so.2,/opt/dockerslim/artifacts/files/lib64/ld-linux-x86-64.so.2) error: symlink /lib/x86_64-linux-gnu/ld-2.31.so /opt/dockerslim/artifacts/files/lib64/ld-linux-x86-64.so.2: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libcap-ng.so.0,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libcap-ng.so.0) error: symlink libcap-ng.so.0.0.0 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libcap-ng.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libaudit.so.1,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libaudit.so.1) error: symlink libaudit.so.1.0.0 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libaudit.so.1: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libutil.so.1,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libutil.so.1) error: symlink libutil-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libutil.so.1: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/usr/lib/sudo/libsudo_util.so.0,/opt/dockerslim/artifacts/files/usr/lib/sudo/libsudo_util.so.0) error: symlink libsudo_util.so.0.0.0 /opt/dockerslim/artifacts/files/usr/lib/sudo/libsudo_util.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libc.so.6,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6) error: symlink libc-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libcap-ng.so.0,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libcap-ng.so.0) error: symlink libcap-ng.so.0.0.0 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libcap-ng.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libpcre2-8.so.0,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpcre2-8.so.0) error: symlink libpcre2-8.so.0.9.0 /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpcre2-8.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libdl.so.2,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libdl.so.2) error: symlink libdl-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libdl.so.2: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib64/ld-linux-x86-64.so.2,/opt/dockerslim/artifacts/files/lib64/ld-linux-x86-64.so.2) error: symlink /lib/x86_64-linux-gnu/ld-2.31.so /opt/dockerslim/artifacts/files/lib64/ld-linux-x86-64.so.2: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libpthread.so.0,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpthread.so.0) error: symlink libpthread-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libpthread.so.0: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib/x86_64-linux-gnu/libc.so.6,/opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6) error: symlink libc-2.31.so /opt/dockerslim/artifacts/files/lib/x86_64-linux-gnu/libc.so.6: file exists"
time="2022-03-23T04:56:00Z" level=warning msg="CopyFile(/lib64/ld-linux-x86-64.so.2,/opt/dockerslim/artifacts/files/lib64/ld-linux-x86-64.so.2) error: symlink /lib/x86_64-linux-gnu/ld-2.31.so /opt/dockerslim/artifacts/files/lib64/ld-linux-x86-64.so.2: file exists"
time="2022-03-23T04:56:00Z" level=info msg="sensor: monitor stopped..."
time="2022-03-23T04:56:00Z" level=info msg="sensor: 'shutdown' command"
time="2022-03-23T04:56:00Z" level=info msg="sensor: done!"
docker-slim: end of container logs =============
cmd=build state=container.inspection.artifact.processing
cmd=build state=container.inspection.done
cmd=build state=building message=building optimized image 
cmd=build log='optimized.image.build' event=LOG.START tag='megabytelabs/updater:slim'  ====================
Step 1/12 : FROM scratch
 ---> 
Step 2/12 : LABEL docker-slim.version="linux|Transformer|1.37.2|ca48b5b3f8da2a791591618103edeb539242d4ac|2021-11-08_04:29:53PM"
 ---> Using cache
 ---> 32a604ae5886
Step 3/12 : ENV PATH "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 ---> Using cache
 ---> d7644833d6a7
Step 4/12 : ENV APP_USER "megabyte"
 ---> Using cache
 ---> 850aeab86651
Step 5/12 : ENV container "docker"
 ---> Using cache
 ---> 06bb65037c4f
Step 6/12 : ENV DEBIAN_FRONTEND "noninteractive"
 ---> Using cache
 ---> bb4b42ad8483
Step 7/12 : ENV NO_INSTALL_HOMEBREW "true"
 ---> Using cache
 ---> 7a8ae395a416
Step 8/12 : ENV NO_INSTALL_POETRY "true"
 ---> Using cache
 ---> 684cd55cb6d9
Step 9/12 : ADD files.tar /
 ---> 91307faceb5e
Step 10/12 : WORKDIR /home/megabyte
 ---> Running in e9b99a0805ac
Removing intermediate container e9b99a0805ac
 ---> 1dae86c25349
Step 11/12 : USER megabyte
 ---> Running in e04c7284c837
Removing intermediate container e04c7284c837
 ---> 4fd28b2edc47
Step 12/12 : CMD ["bash"]
 ---> Running in 83e907f854bc
Removing intermediate container 83e907f854bc
 ---> ac66e1e0983d
Successfully built ac66e1e0983d
Successfully tagged megabytelabs/updater:slim

cmd=build log='optimized.image.build' event=LOG.END tag='megabytelabs/updater:slim'  ====================
cmd=build state=completed
cmd=build info=results size.optimized='191 MB' status='MINIFIED' by='4.27X' size.original='816 MB' 
cmd=build info=results image.name='megabytelabs/updater:slim' image.size='191 MB' has.data='true' 
cmd=build info=results artifacts.location='/tmp/docker-slim-state/.docker-slim-state/images/9aebaaa664976b75cc908b0b3c3a811b9e36e30fff9bf74a77475bad922a6efa/artifacts' 
cmd=build info=results artifacts.report='creport.json' 
cmd=build info=results artifacts.dockerfile.reversed='Dockerfile.fat' 
cmd=build info=results artifacts.dockerfile.optimized='Dockerfile' 
cmd=build info=results artifacts.seccomp='megabytelabs-updater-seccomp.json' 
cmd=build info=results artifacts.apparmor='megabytelabs-updater-apparmor-profile' 
cmd=build state=done
cmd=build info=commands message='use the xray command to learn more about the optimize image' 
cmd=build info=version status='OUTDATED' local='1.37.2' current='1.37.5' 
cmd=build message='Your version of DockerSlim is out of date! Use the "update" command or download the new version from https://dockersl.im/downloads.html'
cmd=build info=report file='slim.report.json' 
docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'

0 replies

kcq · 2022-03-27T05:40:09Z

kcq
Mar 27, 2022
Maintainer

Working on a repro... We'll figure it out :)

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to make Ubuntu keep sudo? #302

{{title}}

Replies: 4 comments

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

How to make Ubuntu keep sudo? #302

ProfessorManhattan Mar 22, 2022

Replies: 4 comments

kcq Mar 22, 2022 Maintainer

ProfessorManhattan Mar 23, 2022 Author

ProfessorManhattan Mar 23, 2022 Author

kcq Mar 27, 2022 Maintainer

ProfessorManhattan
Mar 22, 2022

kcq
Mar 22, 2022
Maintainer

ProfessorManhattan
Mar 23, 2022
Author

ProfessorManhattan
Mar 23, 2022
Author

kcq
Mar 27, 2022
Maintainer