Remove write permission for others in tar installed images (#221)

TravisEz13 · web-flow · commit d93bbedb86b7 · 2019-04-25T13:09:38.000-07:00
diff --git a/release/community-stable/archlinux/docker/Dockerfile b/release/community-stable/archlinux/docker/Dockerfile
@@ -60,8 +60,8 @@ RUN \
     && rm -f /tmp/powershell-linux.tar.gz \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/community-stable/blackarch/docker/Dockerfile b/release/community-stable/blackarch/docker/Dockerfile
@@ -75,8 +75,8 @@ RUN \
     && rm -f /tmp/powershell-linux.tar.gz \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/community-stable/parrot/docker/Dockerfile b/release/community-stable/parrot/docker/Dockerfile
@@ -69,8 +69,8 @@ RUN \
     && apt-get install -y /tmp/powershell.deb \
     # remove powershell package
     && rm -f /tmp/powershell.deb \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/community-stable/photon/docker/Dockerfile b/release/community-stable/photon/docker/Dockerfile
@@ -79,8 +79,8 @@ RUN \
     && locale-gen.sh \
     # create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/preview/alpine/docker/Dockerfile b/release/preview/alpine/docker/Dockerfile
@@ -70,8 +70,8 @@ RUN apk add --no-cache \
     \
     # Create the pwsh-preview symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh-preview \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/preview/opensuse423/docker/Dockerfile b/release/preview/opensuse423/docker/Dockerfile
@@ -64,8 +64,8 @@ RUN zypper --non-interactive update --skip-interactive \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
     && ln -sf ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh-preview \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # clean package manager cache
     && zypper clean -a \
     # remove package manager log file
diff --git a/release/servicing/alpine/docker/Dockerfile b/release/servicing/alpine/docker/Dockerfile
@@ -67,8 +67,8 @@ RUN apk add --no-cache \
     \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/servicing/opensuse423/docker/Dockerfile b/release/servicing/opensuse423/docker/Dockerfile
@@ -63,8 +63,8 @@ RUN zypper --non-interactive update --skip-interactive \
     && localedef --charmap=UTF-8 --inputfile=en_US $LANG \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # clean package manager cache
     && zypper clean -a \
     # remove package manager log file
diff --git a/release/stable/alpine/docker/Dockerfile b/release/stable/alpine/docker/Dockerfile
@@ -67,8 +67,8 @@ RUN apk add --no-cache \
     \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # intialize powershell module cache
     && pwsh \
         -NoLogo \
diff --git a/release/stable/opensuse423/docker/Dockerfile b/release/stable/opensuse423/docker/Dockerfile
@@ -63,8 +63,8 @@ RUN zypper --non-interactive update --skip-interactive \
     && localedef --charmap=UTF-8 --inputfile=en_US $LANG \
     # Create the pwsh symbolic link that points to powershell
     && ln -s ${PS_INSTALL_FOLDER}/pwsh /usr/bin/pwsh \
-    # Give all user execute permissions
-    && chmod a+x ${PS_INSTALL_FOLDER}/pwsh \
+    # Give all user execute permissions and remove write permissions for others
+    && chmod a+x,o-w ${PS_INSTALL_FOLDER}/pwsh \
     # clean package manager cache
     && zypper clean -a \
     # remove package manager log file
diff --git a/tests/container.tests.ps1 b/tests/container.tests.ps1
@@ -328,7 +328,7 @@ Describe "Linux Containers" -Tags 'Behavior', 'Linux' {
             )
         }
 
-        it "The permissions for pwsh should be correct in <channel>-<Name>" -TestCases $permissionsTestCases -Skip:$script:skipLinuxRun {
+        it "pwsh should have execute permissions for all in <channel>-<Name>" -TestCases $permissionsTestCases -Skip:$script:skipLinuxRun {
             param(
                 [Parameter(Mandatory=$true)]
                 [string]
@@ -347,6 +347,25 @@ Describe "Linux Containers" -Tags 'Behavior', 'Linux' {
             $permissions = Get-DockerImagePwshPermissions -Name $name -Path $path
             $permissions | Should -Match '^[\-rw]{3}x([\-rw]{2}x){2}$' -Because 'Everyone should be able to execute'
         }
+        it "pwsh should NOT have write permissions for others in <channel>-<Name>" -TestCases $permissionsTestCases -Skip:$script:skipLinuxRun {
+            param(
+                [Parameter(Mandatory=$true)]
+                [string]
+                $name,
+                [string]
+                $Channel
+            )
+
+            $path = '/opt/microsoft/powershell/6/pwsh'
+
+            if($Channel -eq 'preview')
+            {
+                $path = '/opt/microsoft/powershell/6-preview/pwsh'
+            }
+
+            $permissions = Get-DockerImagePwshPermissions -Name $name -Path $path
+            $permissions | Should -Match '^[\-rwx]{4}[\-rwx]{3}[\-rx]{3}$' -Because 'Others should not be able to write'
+        }
     }
 
     Context "default executables" {
