From bf3ce26be85a7d90508a47ca4968d7b0e85bfce4 Mon Sep 17 00:00:00 2001
From: Romain Winieski <winieski@progress.com>
Date: Tue, 13 Oct 2026 13:32:05 +0200
Subject: [PATCH 1/2] fix SUID and SGID issue

---
 dockerFiles/marklogic-server-ubi-rootless:base | 5 +++++
 dockerFiles/marklogic-server-ubi9-arm:base     | 5 +++++
 dockerFiles/marklogic-server-ubi:base          | 5 +++++
 3 files changed, 15 insertions(+)

diff --git a/dockerFiles/marklogic-server-ubi-rootless:base b/dockerFiles/marklogic-server-ubi-rootless:base
index b9f7db3a..fc944cb7 100644
--- a/dockerFiles/marklogic-server-ubi-rootless:base
+++ b/dockerFiles/marklogic-server-ubi-rootless:base
@@ -175,6 +175,11 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod u-s "$file"; fi; \
+    done \
+    && if [ -e /usr/bin/write ]; then chmod g-s /usr/bin/write; fi
+
 ###############################################################
 # expose MarkLogic server ports
 ###############################################################
diff --git a/dockerFiles/marklogic-server-ubi9-arm:base b/dockerFiles/marklogic-server-ubi9-arm:base
index 06487086..fd4448b0 100644
--- a/dockerFiles/marklogic-server-ubi9-arm:base
+++ b/dockerFiles/marklogic-server-ubi9-arm:base
@@ -120,6 +120,11 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod u-s "$file"; fi; \
+    done \
+    && if [ -e /usr/bin/write ]; then chmod g-s /usr/bin/write; fi
+
 ###############################################################
 # expose MarkLogic server ports
 ###############################################################
diff --git a/dockerFiles/marklogic-server-ubi:base b/dockerFiles/marklogic-server-ubi:base
index 65e723c7..1bd38866 100644
--- a/dockerFiles/marklogic-server-ubi:base
+++ b/dockerFiles/marklogic-server-ubi:base
@@ -121,6 +121,11 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod u-s "$file"; fi; \
+    done \
+    && if [ -e /usr/bin/write ]; then chmod g-s /usr/bin/write; fi
+
 ###############################################################
 # expose MarkLogic server ports
 ###############################################################

From be0b42c58babb0988ec82d58b09fa82834b8d032 Mon Sep 17 00:00:00 2001
From: Romain Winieski <winieski@progress.com>
Date: Tue, 13 Oct 2026 13:43:49 +0200
Subject: [PATCH 2/2] remove keystore SUID issue

---
 dockerFiles/marklogic-server-ubi-rootless:base | 6 ++++--
 dockerFiles/marklogic-server-ubi9-arm:base     | 6 ++++--
 dockerFiles/marklogic-server-ubi:base          | 6 ++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/dockerFiles/marklogic-server-ubi-rootless:base b/dockerFiles/marklogic-server-ubi-rootless:base
index fc944cb7..04c1869e 100644
--- a/dockerFiles/marklogic-server-ubi-rootless:base
+++ b/dockerFiles/marklogic-server-ubi-rootless:base
@@ -175,10 +175,12 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
-RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount /var/lib/tpm2-tss/system/keystore; do \
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount; do \
         if [ -e "$file" ]; then chmod u-s "$file"; fi; \
     done \
-    && if [ -e /usr/bin/write ]; then chmod g-s /usr/bin/write; fi
+    && for file in /usr/bin/write /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod g-s "$file"; fi; \
+    done
 
 ###############################################################
 # expose MarkLogic server ports
diff --git a/dockerFiles/marklogic-server-ubi9-arm:base b/dockerFiles/marklogic-server-ubi9-arm:base
index fd4448b0..c05e53f4 100644
--- a/dockerFiles/marklogic-server-ubi9-arm:base
+++ b/dockerFiles/marklogic-server-ubi9-arm:base
@@ -120,10 +120,12 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
-RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount /var/lib/tpm2-tss/system/keystore; do \
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount; do \
         if [ -e "$file" ]; then chmod u-s "$file"; fi; \
     done \
-    && if [ -e /usr/bin/write ]; then chmod g-s /usr/bin/write; fi
+    && for file in /usr/bin/write /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod g-s "$file"; fi; \
+    done
 
 ###############################################################
 # expose MarkLogic server ports
diff --git a/dockerFiles/marklogic-server-ubi:base b/dockerFiles/marklogic-server-ubi:base
index 1bd38866..5139129c 100644
--- a/dockerFiles/marklogic-server-ubi:base
+++ b/dockerFiles/marklogic-server-ubi:base
@@ -121,10 +121,12 @@ RUN for package in vim-minimal cups-client cups-libs tar avahi-libs binutils lib
     do rpm -e --nodeps $package || true; \
     done;
 
-RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount /var/lib/tpm2-tss/system/keystore; do \
+RUN for file in /usr/sbin/unix_chkpwd /usr/bin/su /usr/bin/umount; do \
         if [ -e "$file" ]; then chmod u-s "$file"; fi; \
     done \
-    && if [ -e /usr/bin/write ]; then chmod g-s /usr/bin/write; fi
+    && for file in /usr/bin/write /var/lib/tpm2-tss/system/keystore; do \
+        if [ -e "$file" ]; then chmod g-s "$file"; fi; \
+    done
 
 ###############################################################
 # expose MarkLogic server ports