sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

[medium] semgrep: Service 'mailserver' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. #28

New Issue
Open
opened 2026-03-18 16:01:24 +00:00 by sharang · 1 comment
sharang commented 2026-03-18 16:01:24 +00:00
Owner
Copy Link
Copy Source

medium Finding

Scanner: semgrep
Severity: medium
Rule: yaml.docker-compose.security.no-new-privileges.no-new-privileges

Description

Service 'mailserver' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this.

Location

File: /tmp/compliance-scanner/repos/Compliance Scanner/deploy/docker-compose.mailserver.yml (line 4)

Code

requires login

Fingerprint: e67b8b8b43d137f064fe7a474eacd1f6930535ec07565e5279870d1d2658c58d
Generated by compliance-scanner

Labels: severity:medium, scanner:semgrep, compliance-scanner

## medium Finding **Scanner:** semgrep **Severity:** medium **Rule:** yaml.docker-compose.security.no-new-privileges.no-new-privileges ### Description Service 'mailserver' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. ### Location **File:** `/tmp/compliance-scanner/repos/Compliance Scanner/deploy/docker-compose.mailserver.yml` (line 4) ### Code ``` requires login ``` --- *Fingerprint:* `e67b8b8b43d137f064fe7a474eacd1f6930535ec07565e5279870d1d2658c58d` *Generated by compliance-scanner* **Labels:** severity:medium, scanner:semgrep, compliance-scanner
sharang commented 2026-07-10 07:52:38 +00:00
Author
Owner
Copy Link
Copy Source

Consolidating mailserver docker-compose hardening here: in addition to no-new-privileges:true (this issue), also add read_only: true with tmpfs for temp paths (was #29 / #54, closed as consolidated into this issue). Single PR touching deploy/docker-compose.mailserver.yml.

Consolidating mailserver docker-compose hardening here: in addition to `no-new-privileges:true` (this issue), also add `read_only: true` with tmpfs for temp paths (was #29 / #54, closed as consolidated into this issue). Single PR touching `deploy/docker-compose.mailserver.yml`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#28