Run mobsf in dockerfile as unprivileged user and fix a few minor bugs. (#1812)

* Run service as unprivileged user

* Update Dockerfile

Co-authored-by: superpoussin22 <[email protected]>
Co-authored-by: Ajin Abraham <[email protected]>

Dockerfile

@@ -52,7 +52,9 @@ ARG TARGETPLATFORM
 COPY scripts/install_java_wkhtmltopdf.sh .
 RUN ./install_java_wkhtmltopdf.sh
 
-WORKDIR /root/Mobile-Security-Framework-MobSF
+RUN groupadd -g 9901 mobsf
+RUN adduser mobsf --shell /bin/false -u 9901 --ingroup mobsf --gecos "" --disabled-password
+
 
 # Install Requirements
 COPY requirements.txt .
@@ -73,12 +75,13 @@ RUN \
     apt autoremove -y && \
     rm -rf /var/lib/apt/lists/* /tmp/* > /dev/null 2>&1
 
+WORKDIR /home/mobsf/Mobile-Security-Framework-MobSF
 # Copy source code
 COPY . .
 
 # Set adb binary path and apktool directory
 RUN sed -i "s#ADB_BINARY = ''#ADB_BINARY = '/usr/bin/adb'#" mobsf/MobSF/settings.py && \
-    mkdir -p /root/.local/share/apktool/framework
+    mkdir -p /home/mobsf/.local/share/apktool/framework
 
 # Postgres support is set to false by default
 ARG POSTGRES=False
@@ -96,5 +99,7 @@ HEALTHCHECK CMD curl --fail http://host.docker.internal:8000/ || exit 1
 # Expose MobSF Port and Proxy Port
 EXPOSE 8000 8000 1337 1337
 
+RUN chown -R mobsf:mobsf /home/mobsf/Mobile-Security-Framework-MobSF
+USER mobsf
 # Run MobSF
-CMD ["/root/Mobile-Security-Framework-MobSF/scripts/entrypoint.sh"]
+CMD ["/home/mobsf/Mobile-Security-Framework-MobSF/scripts/entrypoint.sh"]

docker-compose.yml

@@ -26,7 +26,7 @@ services:
       args:
        - POSTGRES=True
     volumes:
-      - $HOME/MobSF/mobsf_data:/root/.MobSF
+      - $HOME/MobSF/mobsf_data:/home/mobsf/.MobSF
     ports:
      - "8000:8000"
     networks:

requirements.txt

@@ -26,5 +26,5 @@ quark-engine==21.6.3
 frida==15.1.6
 # For semgrep & mitmproxy
 ruamel.yaml==0.16.13 # pyup: ignore
-click==7.1.2 # pyup: ignore
+click==8.0.1 # pyup: ignore
 decorator==4.4.2 # pyup: ignore