Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cleanup copy-and-paste typos in syscall.Setuid rule #592

Merged
merged 1 commit into from
Sep 14, 2024
Merged

Cleanup copy-and-paste typos in syscall.Setuid rule #592

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions precli/rules/go/stdlib/syscall_setuid_root.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,19 +40,19 @@
> precli tests/unit/rules/go/stdlib/os/examples/syscall_setuid_0.go
⛔️ Error on line 16 in tests/unit/rules/go/stdlib/os/examples/syscall_setuid_0.go
GO004: Execution with Unnecessary Privileges
The function 'os.setuid(0)' escalates the process to run with root (superuser) privileges.
The function 'syscall.Setuid(0)' escalates the process to run with root (superuser) privileges.
```

## Remediation

- Avoid using setuid(0) unless absolutely necessary: Review whether running
- Avoid using Setuid(0) unless absolutely necessary: Review whether running
as the root user is required for the task at hand. It is safer to operate
with the least privileges necessary.
- Drop privileges as soon as possible: If elevated privileges are required
temporarily, ensure that the process drops those privileges immediately
after performing the necessary tasks.
- Validate input to avoid malicious manipulation: If input parameters control
the user ID passed to setuid(), ensure they are securely validated and not
the user ID passed to Setuid(), ensure they are securely validated and not
influenced by untrusted sources.
- Use alternatives to running as root: If feasible, design your application
to avoid needing root privileges entirely. Consider utilizing a dedicated
Expand Down