Error: failed to write output: open tfsec_checks.markdown: permission denied

[lhoupert]

Hi, I encountered a write permission issue when trying to output the tfsec checks.

I can run the command below succesfully:
docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src --include-ignored

But if I run

 docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src  --out tfsec_checks -f markdown,html

or

docker run --rm -it -v "$(pwd):/src" aquasec/tfsec /src  --out "tfsec_checks" -f "markdown,html"

I receive this error:

=====================================================
tfsec is joining the Trivy family

tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.

You can read more here:
https://github.com/aquasecurity/tfsec/discussions/1994
======================================================
Error: failed to write output: open tfsec_checks.markdown: permission denied

Is there an easy way to fix this?

I had no problem running kics in a container an exporting the report with the command below:

docker pull checkmarx/kics:latest
docker run -v .:/data checkmarx/kics:latest scan -p "/data" --report-formats "json,html" -o "/data/kics_scan_results"

Thank you!

[simar7]

As shown in the output you shared, our efforts have moved to Trivy (https://github.com/aquasecurity/tfsec/discussions/1994). Have you had any issues migrating to Trivy?

Furthermore I don't think this error is related to either tfsec or Trivy but rather sounds like you might have permissions issues with the directory you're working with?

[lhoupert]

Yes I tried trivy but doesn't seem to be working on my laptop due to some tls error:

docker run --rm -it -v "$(pwd):/src" aquasec/trivy fs /src  -o "trivy_checks"
2024-01-11T10:04:44.395Z	INFO	Need to update DB
2024-01-11T10:04:44.395Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2024-01-11T10:04:44.395Z	INFO	Downloading DB...
2024-01-11T10:04:44.840Z	FATAL	init error: DB error: failed to download vulnerability DB: database download error: OCI repository error: 1 error occurred:
	* Get "https://ghcr.io/v2/": tls: failed to verify certificate: x509: certificate signed by unknown authority

I have not problem generating a report using the kics docker image working on the same repository

docker run -v .:/data checkmarx/kics:latest scan -p "/data" --report-formats "json,html" -o "/data/kics_scan_results"

Which make me believe it comes from the tfsec docker image. Anyway I am very happy with checkov and kics results so I may just go with them.

NOTE: If I want to make the trivy docker image work on my machine, I need to create a custom docker image where I copy my SSL certificate in it:

FROM aquasec/trivy

COPY zscaler.pem ./zscaler.pem
RUN tee -a /etc/ssl/certs/ca-certificates.crt < ./zscaler.pem
ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

[nikpivkin]

Hi @lhoupert !

Maybe this will help you?

[lhoupert]

Oh thank you I missed that!
I used it as an environment variable:
I tried :

docker run --rm -it -v "$(pwd):/src" -e TRIVY_INSECURE='true' aquasec/trivy fs --scanners vuln,misconfig,secret /src

but now I have another error:

docker run --rm -it -v "$(pwd):/src" -e TRIVY_INSECURE='true' aquasec/trivy fs --scanners vuln,misconfig,secret /src
2024-01-11T11:19:07.590Z	INFO	Need to update DB
2024-01-11T11:19:07.590Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2024-01-11T11:19:07.590Z	INFO	Downloading DB...
2024-01-11T11:19:09.858Z	FATAL	init error: DB error: failed to download vulnerability DB: database download error: OCI repository error: 1 error occurred:
	* Get "https://ghcr.io/token?scope=repository%3Aaquasecurity%2Ftrivy-db%3Apull&service=ghcr.io": stopped after 10 redirects