Extra "db" string in the trivy cache path.

[CsorbaRobertAlfa]

Description

I use the trivy server with the following systemd unit file:

[Unit]
Description="Aquasecurity Trivy."
After=network-online.target
StartLimitIntervalSec=520
StartLimitBurst=2

[Service]
UMask=027

Type=simple
RemainAfterExit=True
ProtectKernelModules=True
ProtectHome=True
RestrictSUIDSGID=True
NoNewPrivileges=True
PrivateTmp=True
ProtectSystem=full
PrivateDevices=True
Restart=on-failure
TimeoutStartSec=520

Environment=TRIVY_CACHE_DIR="/var/cache/trivy/subpath"
Environment=TRIVY_CACHE_BACKEND="redis://localhost:6379"
Environment=TRIVY_LISTEN="127.0.0.1:4954"
Environment=TRIVY_CACHE_TTL="3600s"
Environment=TRIVY_NO_PROGRESS="true"
Environment=TRIVY_TIMEOUT="1800s"
Environment=TRIVY_DEBUG="true"
Environment=TRIVY_QUIET="false"
Environment=TRIVY_JAVA_DB_REPOSITORY="<corporate_repository>/aquasecurity/trivy-java-db:1"
Environment=TRIVY_DB_REPOSITORY="<corporate_repository>/aquasecurity/trivy-db:2"
Environment=TRIVY_CHECKS_BUNDLE_REPOSITORY="<corporate_repository>/aquasecurity/trivy-checks:0"

ExecStartPre=/usr/bin/trivy image --download-java-db-only
ExecStartPre=/usr/bin/trivy image --download-db-only
ExecStartPre=/usr/bin/trivy --version
ExecStart=/usr/bin/trivy server

[Install]
WantedBy=multi-user.target

I noticed an extra string has been added to the trivy cache path. (see below in the debug output)

Desired Behavior

ls -lsa /var/cache/trivy/subpath/db/metadata.json
4.0K -rw-r--r--. 1 root root 152 Aug 23 14:48 /var/cache/trivy/subpath/db/metadata.json

Actual Behavior

ls -lsa /var/cache/trivy/subpath/db/db/metadata.json
ls: cannot access '/var/cache/trivy/subpath/db/db/metadata.json': No such file or directory

Reproduction Steps

Upgrade trivy from version 0.51.1 to version 0.54.1

Target

None

Scanner

None

Output Format

None

Mode

Client/Server

Debug Output

DEBUG        Failed to get DB metadata        err="unable to open a file: open /var/cache/trivy/subpath/db/db/metadata.json: no such file or directory"
DEBUG        Failed to get Java DB metadata        err="unable to open a file: open /var/cache/trivy/subpath/db/java-db/metadata.json: no such file or directory"
DEBUG        Failed to open the check metadata        err="open /var/cache/trivy/subpath/db/policy/metadata.json: no such file or directory"
DEBUG        Failed to get policy metadata        err="open /var/cache/trivy/subpath/db/policy/metadata.json: no such file or directory"

Operating System

OracleLinux 8.10

Version

Version: 0.54.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

It's not expected. @afdesk Can you please take a look?

[afdesk]

Hi @CsorbaRobertAlfa! thanks for the report!
it seems I could reproduce your issue:

$ ls -l ~/Library/Caches/trivy
total 0
drwxr-xr-x  4 user  staff  128 27 Aug 00:25 db
drwx------  3 user  staff   96 26 Aug 14:02 fanal
drwxr-xr-x@ 4 user  staff  128 16 Aug 12:45 java-db
drwxr-xr-x@ 4 user  staff  128 19 Aug 19:47 policy
drwx------  4 user  staff  128 27 Aug 01:15 subpath

a new folder has created without read access for another users.

[afdesk]

created #7395

[knqyf263]

@afdesk Please create an issue first to describe the problem.

[afdesk]

@afdesk Please create an issue first to describe the problem.

I have no permissions to create a new issue (

[afdesk]

@CsorbaRobertAlfa you can track #7399
thanks!

[afdesk]

I reopened this discussion for a while I'm retesting it

[afdesk]

@CsorbaRobertAlfa I managed to reproduce your error messages. it seems there are no files in your subfolder, so Trivy can't check a version.

I see you use a custom repository for the script.
Could you confirm that Trivy works correctly without subfolder?
thanks

trivy -v --cache-dir ~/Library/Caches/trivy -d
2024-09-02T19:13:11+06:00	DEBUG	Cache dir	dir="/Library/Caches/trivy"
2024-09-02T19:13:11+06:00	DEBUG	Failed to get Java DB metadata	err="unable to open a file: open ~/Library/Caches/trivy/java-db/metadata.json: no such file or directory"
2024-09-02T19:13:11+06:00	DEBUG	Failed to open the check metadata	err="open ~/Library/Caches/trivy/policy/metadata.json: no such file or directory"
2024-09-02T19:13:11+06:00	DEBUG	Failed to get policy metadata	err="open ~/Library/Caches/trivy/policy/metadata.json: no such file or directory"
Version: 0.54.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-02 12:13:01.826120224 +0000 UTC
  NextUpdate: 2024-09-02 18:13:01.826119422 +0000 UTC
  DownloadedAt: 2024-09-02 13:13:03.334095 +0000 UTC
$ ls -lsa ~/Library/Caches/trivy                        
total 0
0 drwxr-xr-x   4 amf  staff   128  
0 drwx------+ 98 amf  staff  3136
0 drwxr-xr-x   4 amf  staff   128 
0 drwx------   3 amf  staff    96

[CsorbaRobertAlfa]

Hi @afdesk

Sorry for my late answer, I was on vacation.

I wrote a very simple script with basic cache settings.

cat trivy_init.sh

#!/usr/bin/env bash

set -x

export TRIVY_CACHE_DIR="/tmp"
export TRIVY_CACHE_BACKEND="fs"
export TRIVY_LISTEN="127.0.0.1:4954"
export TRIVY_DEBUG="true"
export TRIVY_QUIET="false"
export TRIVY_NO_PROGRESS="true"

/usr/bin/trivy image --download-java-db-only
/usr/bin/trivy image --download-db-only
/usr/bin/trivy --version
/usr/bin/trivy server

The output of the script is the following:

2024-09-24T13:05:53+02:00       DEBUG   Cache dir       dir="/tmp"
2024-09-24T13:05:53+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-24T13:05:53+02:00       DEBUG   Ignore statuses statuses=[]
2024-09-24T13:05:53+02:00       INFO    Java DB Repository      repository=ghcr.io/aquasecurity/trivy-java-db:1
2024-09-24T13:05:53+02:00       INFO    Downloading the Java DB...
2024-09-24T13:06:11+02:00       INFO    The Java DB is cached for 3 days. If you want to update the database more frequently, "trivy clean --java-db" command clears the DB cache.
+ /usr/bin/trivy image --download-db-only
2024-09-24T13:06:12+02:00       DEBUG   Cache dir       dir="/tmp"
2024-09-24T13:06:12+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-24T13:06:12+02:00       DEBUG   Ignore statuses statuses=[]
2024-09-24T13:06:12+02:00       DEBUG   DB update was skipped because the local DB is the latest
2024-09-24T13:06:12+02:00       DEBUG   DB info schema=2 updated_at=2024-09-24T06:14:03.075540497Z next_update=2024-09-24T12:14:03.075540226Z downloaded_at=2024-09-24T10:57:27.743975493Z
+ /usr/bin/trivy --version
2024-09-24T13:06:12+02:00       DEBUG   Cache dir       dir="/tmp"
2024-09-24T13:06:12+02:00       DEBUG   Failed to open the check metadata       err="open /tmp/policy/metadata.json: no such file or directory"
2024-09-24T13:06:12+02:00       DEBUG   Failed to get policy metadata   err="open /tmp/policy/metadata.json: no such file or directory"
Version: 0.54.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-24 06:14:03.075540497 +0000 UTC
  NextUpdate: 2024-09-24 12:14:03.075540226 +0000 UTC
  DownloadedAt: 2024-09-24 10:57:27.743975493 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-09-20 01:06:28.762321776 +0000 UTC
  NextUpdate: 2024-09-23 01:06:28.762321626 +0000 UTC
  DownloadedAt: 2024-09-24 11:06:11.646509656 +0000 UTC
+ /usr/bin/trivy server
2024-09-24T13:06:13+02:00       DEBUG   Cache dir       dir="/tmp"
2024-09-24T13:06:13+02:00       DEBUG   Initializing scan cache...      type="fs"
2024-09-24T13:06:13+02:00       DEBUG   DB update was skipped because the local DB is the latest
2024-09-24T13:06:13+02:00       DEBUG   DB info schema=2 updated_at=2024-09-24T06:14:03.075540497Z next_update=2024-09-24T12:14:03.075540226Z downloaded_at=2024-09-24T10:57:27.743975493Z
2024-09-24T13:06:13+02:00       INFO    Listening 127.0.0.1:4954...

The cache folder content is the following:

ls -lsa /tmp/{db,java-db}
/tmp/db:
total 508M
4.0K drwxr-xr-x.  2 root root 4.0K Sep 24 12:57 .
4.0K drwxrwxrwt. 13 root root 4.0K Sep 24 13:38 ..
4.0K -rw-r--r--.  1 root root  153 Sep 24 12:57 metadata.json
508M -rw-------.  1 root root 508M Sep 24 08:16 trivy.db

/tmp/java-db:
total 1.1G
4.0K drwxr-xr-x.  2 root root 4.0K Sep 24 13:06 .
4.0K drwxrwxrwt. 13 root root 4.0K Sep 24 13:38 ..
4.0K -rw-r--r--.  1 root root  153 Sep 24 13:06 metadata.json
1.1G -rw-r--r--.  1 root root 1.1G Sep 20 03:06 trivy-java.db`

When I want to check the database version I was able to reproduce the erro messages.

curl 127.0.0.1:4954/version

2024-09-24T13:41:32+02:00       DEBUG   Failed to get DB metadata       err="unable to open a file: open /tmp/db/db/metadata.json: no such file or directory"
2024-09-24T13:41:32+02:00       DEBUG   Failed to get Java DB metadata  err="unable to open a file: open /tmp/db/java-db/metadata.json: no such file or directory"
2024-09-24T13:41:32+02:00       DEBUG   Failed to open the check metadata       err="open /tmp/db/policy/metadata.json: no such file or directory"
2024-09-24T13:41:32+02:00       DEBUG   Failed to get policy metadata   err="open /tmp/db/policy/metadata.json: no such file or directory"
2024-09-24T13:41:35+02:00       DEBUG   Failed to get DB metadata       err="unable to open a file: open /tmp/db/db/metadata.json: no such file or directory"
2024-09-24T13:41:35+02:00       DEBUG   Failed to get Java DB metadata  err="unable to open a file: open /tmp/db/java-db/metadata.json: no such file or directory"
2024-09-24T13:41:35+02:00       DEBUG   Failed to open the check metadata       err="open /tmp/db/policy/metadata.json: no such file or directory"
2024-09-24T13:41:35+02:00       DEBUG   Failed to get policy metadata   err="open /tmp/db/policy/metadata.json: no such file or directory"

[afdesk]

@CsorbaRobertAlfa
thanks for the details!

let me recheck it.

[afdesk]

@CsorbaRobertAlfa it's a bit strange, but I can't reproduce the issue.
I got the same:

ls -lsa /tmp/t/{db,java-db}
Password:
/tmp/t/db:
total 1068568
      0 drwxr-xr-x  4 root  wheel        128 26 sep 11:34 .
      0 drwx------  5 root  wheel        160 26 sep 11:34 ..
      8 -rw-r--r--  1 root  wheel        150 26 sep 11:34 metadata.json
1068560 -rw-------  1 root  wheel  547102720 26 sep 06:22 trivy.db

/tmp/t/java-db:
total 2144968
      0 drwxr-xr-x  4 root  wheel         128 26 sep 11:33 .
      0 drwx------  5 root  wheel         160 26 sep 11:34 ..
      8 -rw-r--r--  1 root  wheel         150 26 sep 11:33 metadata.json
2144960 -rw-r--r--  1 root  wheel  1096851456 26 sep 06:19 trivy-java.db

I can see next, but these logs are OK because the policies weren't downloaded:

2024-09-26T11:35:57+06:00	DEBUG	Failed to open the check metadata	err="open /tmp/t/policy/metadata.json: no such file or directory"
2024-09-26T11:35:57+06:00	DEBUG	Failed to get policy metadata	err="open /tmp/t/policy/metadata.json: no such file or directory"

[CsorbaRobertAlfa]

@afdesk

Please test it with with curl to check the current DB versions.

curl -v 127.0.0.1:4954/version

[CsorbaRobertAlfa]

In version 0.55.2 I only see the following error messages.

2024-09-24T13:58:16+02:00       DEBUG   Failed to open the check metadata       err="open /tmp/policy/metadata.json: no such file or directory"
2024-09-24T13:58:16+02:00       DEBUG   Failed to get policy metadata   err="open /tmp/policy/metadata.json: no such file or directory"
2024-09-24T13:58:18+02:00       DEBUG   Failed to open the check metadata       err="open /tmp/policy/metadata.json: no such file or directory"
2024-09-24T13:58:18+02:00       DEBUG   Failed to get policy metadata   err="open /tmp/policy/metadata.json: no such file or directory"
2024-09-24T13:58:21+02:00       DEBUG   Failed to open the check metadata       err="open /tmp/policy/metadata.json: no such file or directory"
2024-09-24T13:58:21+02:00       DEBUG   Failed to get policy metadata   err="open /tmp/policy/metadata.json: no such file or directory"

[afdesk]

that's OK, because Trivy doesn't download the policies for server mode, Trivy does misconfiguration scan only on client side.