Fix Insecure File Permissions (#175)

Changes to disable read and write permissions to the group user

Signed-off-by: asararatnakar <[email protected]>
Signed-off-by: Shoaeb Jindani <[email protected]>

Author: asararatnakar

definitions/ca/deployment.yaml

@@ -82,6 +82,7 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: false
+            runAsGroup: 7051
             runAsNonRoot: true
             runAsUser: 7051
           volumeMounts:
@@ -130,6 +131,7 @@ spec:
             runAsUser: 0
       securityContext:
         fsGroup: 7051
+        runAsGroup: 7051
         runAsNonRoot: true
         runAsUser: 7051
       serviceAccountName: sample

definitions/console/deployment.yaml

@@ -70,6 +70,7 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: false
+            runAsGroup: 1000
             runAsNonRoot: true
             runAsUser: 1000
           volumeMounts:
@@ -117,6 +118,7 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: false
+            runAsGroup: 1000
             runAsNonRoot: true
             runAsUser: 1000
           volumeMounts:
@@ -199,6 +201,7 @@ spec:
             runAsUser: 0
       securityContext:
         fsGroup: 2000
+        runAsGroup: 1000
         runAsNonRoot: true
         runAsUser: 1000
       serviceAccountName: sample

definitions/orderer/deployment.yaml

@@ -80,6 +80,7 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: false
+            runAsGroup: 7051
             runAsNonRoot: true
             runAsUser: 7051
           startupProbe:
@@ -171,6 +172,7 @@ spec:
                 - ALL
             privileged: false
             readOnlyRootFilesystem: false
+            runAsGroup: 1000
             runAsNonRoot: true
             runAsUser: 1000
           volumeMounts:
@@ -221,6 +223,7 @@ spec:
               subPath: data
       securityContext:
         fsGroup: 2000
+        runAsGroup: 1000
         runAsNonRoot: true
         runAsUser: 1000
       serviceAccountName: sample

definitions/peer/chaincode-launcher.yaml

@@ -20,6 +20,7 @@ imagePullPolicy: Always
 securityContext:
   privileged: false
   readOnlyRootFileSystem: false
+  runAsGroup: 7051
   runAsNonRoot: true
   runAsUser: 7051
   capabilities:

definitions/peer/couchdb.yaml

@@ -21,6 +21,7 @@ imagePullPolicy: Always
 securityContext:
   privileged: false
   readOnlyRootFileSystem: false
+  runAsGroup: 5984
   runAsNonRoot: true
   runAsUser: 5984
   capabilities: