✨ adds USER instruction to Dockerfile (#3937)

* ✨ adds USER declaritive to Dockerfile Signed-off-by: Scott Ford <scott@scottford.io> Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> * 🧪 add test cases for dockerfile resource Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> * 🔨 update protoc-gen-go v1.34.1 Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> * 💡 updates from code review Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> --------- Signed-off-by: Scott Ford <scott@scottford.io> Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> Co-authored-by: Salim Afiune Maya <afiune@mondoo.com>
mondoohq · May 9, 2024 · 787ec84 · 787ec84
1 parent 4288779
commit 787ec84
Show file tree

Hide file tree

Showing 22 changed files with 331 additions and 75 deletions.
diff --git a/cli/reporter/cnquery_report.pb.go b/cli/reporter/cnquery_report.pb.go
diff --git a/explorer/cnquery_explorer.pb.go b/explorer/cnquery_explorer.pb.go
diff --git a/explorer/resources/cnquery_resources_explorer.pb.go b/explorer/resources/cnquery_resources_explorer.pb.go
diff --git a/explorer/scan/cnquery_explorer_scan.pb.go b/explorer/scan/cnquery_explorer_scan.pb.go
diff --git a/llx/llx.pb.go b/llx/llx.pb.go
diff --git a/providers-sdk/v1/inventory/inventory.pb.go b/providers-sdk/v1/inventory/inventory.pb.go
diff --git a/providers-sdk/v1/plugin/plugin.pb.go b/providers-sdk/v1/plugin/plugin.pb.go
diff --git a/providers-sdk/v1/resources/resources.pb.go b/providers-sdk/v1/resources/resources.pb.go
diff --git a/providers-sdk/v1/upstream/health/errors.pb.go b/providers-sdk/v1/upstream/health/errors.pb.go
diff --git a/providers-sdk/v1/upstream/health/health.pb.go b/providers-sdk/v1/upstream/health/health.pb.go
diff --git a/providers-sdk/v1/upstream/mvd/cvss/cvss.pb.go b/providers-sdk/v1/upstream/mvd/cvss/cvss.pb.go
diff --git a/providers-sdk/v1/upstream/mvd/mvd.pb.go b/providers-sdk/v1/upstream/mvd/mvd.pb.go
diff --git a/providers-sdk/v1/upstream/upstream.pb.go b/providers-sdk/v1/upstream/upstream.pb.go
diff --git a/providers-sdk/v1/vault/vault.pb.go b/providers-sdk/v1/vault/vault.pb.go
diff --git a/providers/azure/resources/azure.lr.manifest.yaml b/providers/azure/resources/azure.lr.manifest.yaml
@@ -9,11 +9,9 @@ resources:
       name:
       - azure
   azure.subscription:
-    refs:
-    - title: Subscriptions, licenses, accounts, and tenants for Microsoft's cloud offerings
-      url: https://learn.microsoft.com/en-us/microsoft-365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings
     docs:
-      desc: Use the `azure.subscription` resource to assess the configuration of Azure subscriptions.
+      desc: Use the `azure.subscription` resource to assess the configuration of Azure
+        subscriptions.
     fields:
       advisor: {}
       aks: {}
@@ -45,12 +43,17 @@ resources:
     platform:
       name:
       - azure
+    refs:
+    - title: Subscriptions, licenses, accounts, and tenants for Microsoft's cloud
+        offerings
+      url: https://learn.microsoft.com/en-us/microsoft-365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings
     snippets:
     - query: "azure.subscription {\n  subscriptionId \n  managedByTenants\n}\n"
       title: Return the subscription ID and a list of tenants that manage the subscription
   azure.subscription.advisor:
     docs:
-      desc: Use the `azure.subscription.advisor` resource to retrieve scoring and recommendations from Microsoft Azure Advisor.
+      desc: Use the `azure.subscription.advisor` resource to retrieve scoring and
+        recommendations from Microsoft Azure Advisor.
     fields:
       recommendations: {}
       subscriptionId: {}
@@ -197,11 +200,6 @@ resources:
     - query: "azure.subscription.aks.clusters {\n  id \n createdAt \n powerState \n}\n"
       title: Return the ID, date and time created, and current power state of clusters
   azure.subscription.aksService:
-    refs:
-    - title: What is Azure Kubernetes Service (AKS)?
-      url: https://learn.microsoft.com/en-us/azure/aks/what-is-aks
-    - title: Azure Kubernetes Service (AKS) documentation
-      url: https://learn.microsoft.com/en-us/azure/aks/
     fields:
       clusters: {}
       subscriptionId: {}
@@ -210,12 +208,12 @@ resources:
     platform:
       name:
       - azure
-  azure.subscription.aksService.cluster:
     refs:
     - title: What is Azure Kubernetes Service (AKS)?
       url: https://learn.microsoft.com/en-us/azure/aks/what-is-aks
     - title: Azure Kubernetes Service (AKS) documentation
       url: https://learn.microsoft.com/en-us/azure/aks/
+  azure.subscription.aksService.cluster:
     fields:
       addonProfiles: {}
       agentPoolProfiles: {}
@@ -242,6 +240,11 @@ resources:
     platform:
       name:
       - azure
+    refs:
+    - title: What is Azure Kubernetes Service (AKS)?
+      url: https://learn.microsoft.com/en-us/azure/aks/what-is-aks
+    - title: Azure Kubernetes Service (AKS) documentation
+      url: https://learn.microsoft.com/en-us/azure/aks/
   azure.subscription.authorization:
     fields:
       roleDefinitions: {}

diff --git a/providers/os/resources/docker_file.go b/providers/os/resources/docker_file.go
@@ -190,6 +190,7 @@ func (p *mqlDockerFile) stage2resource(stage instructions.Stage) (*mqlDockerFile
 	var unsupported []string
 	var entrypointRaw *instructions.EntrypointCommand
 	var cmdRaw *instructions.CmdCommand
+	var userRaw *instructions.UserCommand
 	for i := range stage.Commands {
 		switch v := stage.Commands[i].(type) {
 		case *instructions.EnvCommand:
@@ -200,6 +201,9 @@ func (p *mqlDockerFile) stage2resource(stage instructions.Stage) (*mqlDockerFile
 			for _, kv := range v.Labels {
 				labels[kv.Key] = kv.Value
 			}
+		case *instructions.UserCommand:
+			userRaw = v
+
 		case *instructions.RunCommand:
 			script := strings.Join(v.ShellDependantCmdLine.CmdLine, "\n")
 			runResource, err := CreateResource(p.MqlRuntime, "docker.file.run", map[string]*llx.RawData{
@@ -324,6 +328,30 @@ func (p *mqlDockerFile) stage2resource(stage instructions.Stage) (*mqlDockerFile
 		args["cmd"] = llx.NilData
 	}
 
+	if userRaw != nil {
+		arr := strings.Split(userRaw.User, ":")
+		var user string
+		var group string
+		if len(arr) != 0 && arr[0] != "" {
+			user = arr[0]
+		}
+
+		if len(arr) > 1 && arr[1] != "" {
+			group = arr[1]
+		}
+		userResource, err := CreateResource(p.MqlRuntime, "docker.file.user", map[string]*llx.RawData{
+			"__id":  llx.StringData(p.locationID(userRaw.Location())),
+			"user":  llx.StringData(user),
+			"group": llx.StringData(group),
+		})
+		if err != nil {
+			return nil, err
+		}
+		args["user"] = llx.ResourceData(userResource, "docker.file.user")
+	} else {
+		args["user"] = llx.NilData
+	}
+
 	rawStage, err := CreateResource(p.MqlRuntime, "docker.file.stage", args)
 	if err != nil {
 		return nil, err