topic Re: Docker running as non-root, but hardening script fails? in Cortex XSOAR Discussions

Docker running as non-root, but hardening script fails?

jboyd98 — Thu, 03 Mar 2022 18:15:11 GMT

Relatively new admin to XSOAR; previous admin has left.

Just completed upgrade to latest 6.5 version.

Could anyone help me understand the following:

I have a service account that seems to run xsoar demisto server containers; used ps-ef|grep demisto and return a number of containers; "demisto" is the user below.

demisto 32710 3808 0 10:56 ? 00:00:02 docker run -i --rm --name demistoserver_pyexec-63f590f3-2b4f-4182-8894-

Why is it that docker hardening script check fails with the following:

Non-root User

Failed: Running as root with uid: 0. It seems that you haven't set the docker container to run with a non-root internal user.

Thanks,

Boyd

Re: Docker running as non-root, but hardening script fails?

asawyer — Thu, 03 Mar 2022 22:55:15 GMT

Hi @jboyd98,

To set Docker containers to run as non-root internal users, please set the server configuration docker.run.internal.asuser to true, as per this document: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.html. After setting that server config and running /reset_containers, all docker hardening checks should pass.

You are seeing the user demisto in your ps -ef | grep demisto output because the demisto user kicks off the docker process. If you have docker.run.internal.asuser set to true, you will see the arg --user <UID> is passed to the docker process. Otherwise, the --user arg does not get passed, so the docker container runs as root, the default behavior.

XSOAR launches a docker container by running a python loop script _script_docker_python_loop.py, which you will see at the end of the line in the ps output. The user that _script_docker_python_loop.py runs as will vary depending on the docker.run.internal.asuser server config value. You can verify this by running: ps -ef | grep _script_docker_python_loop.py

The loop script is explained in more detail here: https://xsoar.pan.dev/docs/integrations/docker#advanced-server---container-communication

Hope that helps!

Re: Docker running as non-root, but hardening script fails?

jboyd98 — Thu, 03 Mar 2022 23:14:44 GMT

Thanks will review -