Provide an Alpine Image with an root password

[stbischof]

Provide an Alpine Image with an root password

https://www.zdnet.com/article/alpine-linux-docker-images-ship-a-root-account-with-no-password/
alpinelinux/docker-alpine#13

[ncopa]

For more info: https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html

[grzesuav]

Does ubuntu and debian images have root password ?

[grzesuav]

We have alpine:3.10 (https://github.com/AdoptOpenJDK/openjdk-docker/blob/master/dockerfile_functions.sh#L79) and according to https://alpinelinux.org/posts/Docker-image-vulnerability-CVE-2019-5021.html (docker-library/official-images#5516) it has been fixed in 3.9.2

[grzesuav]

Surprisingly, when I start alpine as non-root user:
docker run -it --user 1000:1000 adoptopenjdk/openjdk11:alpine-jre ash
and execute
su
I get
su: must be suid to work properly

[grzesuav]

Ok, got it right :
docker run -it adoptopenjdk/openjdk11:alpine-jre ash
adduser -D myUser
su -l myUser
and I am myUser, however when I try to do su I get su: must be suid to work properly.

Solution - install busybox-suid (apk add busybox-suid) while being root.

[grzesuav]

@karianna I think this issue can be closed as not valid

[ncopa]

su: must be suid to work properly

Correct. This means that even if you had an unfixed version of alpine, you would still not be affected. You would not even be affected if you installed busybox-suid. You would only be affected if you had the shadow package installed (or used PAM in other way).