From 21fe2bdab3d6e920ff6ef2cacb6b2fd86ef4e8c2 Mon Sep 17 00:00:00 2001
From: Saurabh Misra <saurabh.misra.iitkgp@gmail.com>
Date: Tue, 5 Nov 2024 09:29:23 +0530
Subject: [PATCH] FIX| RKE-CIS-1.24- CHECK 1.1.19 We have added the missing
 script required for check 1.1.19 in rke-cis-1.24 and made it available to the
 kube-bench file
 system(https://github.com/rancher/security-scan/blob/master/package/helper_scripts/check_files_owner_in_dir.sh).

---
 Dockerfile                                 |  3 ++
 Dockerfile.fips.ubi                        |  1 +
 Dockerfile.ubi                             |  1 +
 helper_scripts/check_files_owner_in_dir.sh | 44 ++++++++++++++++++++++
 4 files changed, 49 insertions(+)
 create mode 100644 helper_scripts/check_files_owner_in_dir.sh

diff --git a/Dockerfile b/Dockerfile
index 30e33e572..4abc81e08 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,8 +13,10 @@ RUN make build && cp kube-bench /go/bin/kube-bench
 ARG KUBECTL_VERSION TARGETARCH
 RUN wget -O /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
 RUN wget -O kubectl.sha256 "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256"
+
 # Verify kubectl sha256sum
 RUN /bin/bash -c 'echo "$(<kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c -'
+
 RUN chmod +x /usr/local/bin/kubectl
 
 FROM alpine:3.20.3 AS run
@@ -44,6 +46,7 @@ COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
 COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
 COPY entrypoint.sh .
 COPY cfg/ cfg/
+COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
 ENTRYPOINT ["./entrypoint.sh"]
 CMD ["install"]
 
diff --git a/Dockerfile.fips.ubi b/Dockerfile.fips.ubi
index c0abae2de..7366152d3 100644
--- a/Dockerfile.fips.ubi
+++ b/Dockerfile.fips.ubi
@@ -42,6 +42,7 @@ COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
 COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
 COPY entrypoint.sh .
 COPY cfg/ cfg/
+COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
 ENTRYPOINT ["./entrypoint.sh"]
 CMD ["install"]
 
diff --git a/Dockerfile.ubi b/Dockerfile.ubi
index f2b0e023b..092b5969d 100644
--- a/Dockerfile.ubi
+++ b/Dockerfile.ubi
@@ -42,6 +42,7 @@ COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
 COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
 COPY entrypoint.sh .
 COPY cfg/ cfg/
+COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
 ENTRYPOINT ["./entrypoint.sh"]
 CMD ["install"]
 
diff --git a/helper_scripts/check_files_owner_in_dir.sh b/helper_scripts/check_files_owner_in_dir.sh
new file mode 100644
index 000000000..58b87b2f8
--- /dev/null
+++ b/helper_scripts/check_files_owner_in_dir.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# This script is used to ensure the owner is set to root:root for
+# the given directory and all the files in it
+#
+# inputs:
+#   $1 = /full/path/to/directory
+#
+# outputs:
+#   true/false
+
+INPUT_DIR=$1
+
+if [[ "${INPUT_DIR}" == "" ]]; then
+    echo "false"
+    exit
+fi
+
+if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then
+    echo "false"
+    exit
+fi
+
+statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*)
+while read -r statInfoLine; do
+  f=$(echo ${statInfoLine} | cut -d' ' -f1)
+  p=$(echo ${statInfoLine} | cut -d' ' -f2)
+
+  if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then
+    if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then
+      echo "false"
+      exit
+    fi
+  else
+    if [[ "$p" != "root:root" ]]; then
+      echo "false"
+      exit
+    fi
+  fi
+done <<< "${statInfoLines}"
+
+
+echo "true"
+exit