2021-05-25 20:49:45 +02:00
#!/bin/bash
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3( ) {
2021-03-10 20:47:52 +01:00
logit ""
2021-03-09 11:42:48 +01:00
local id = "3"
local desc = "Docker daemon configuration files"
2021-03-10 20:47:52 +01:00
checkHeader = " $id - $desc "
info " $checkHeader "
2021-03-09 11:42:48 +01:00
startsectionjson " $id " " $desc "
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_1( ) {
2021-03-09 11:42:48 +01:00
local id = "3.1"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the docker.service file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "Find out the file location: systemctl show -p FragmentPath docker.service. If the file does not exist, this recommendation is not applicable. If the file does exist, you should run the command chown root:root <path>, in order to set the ownership and group ownership for the file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-05-25 20:49:45 +02:00
file = $( get_service_file docker.service)
2018-01-16 13:46:49 +01:00
if [ -f " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %u%g " $file " ) " -eq 00 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_2( ) {
2021-03-09 11:42:48 +01:00
local id = "3.2"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that docker.service file permissions are appropriately set (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "Find out the file location: systemctl show -p FragmentPath docker.service. If the file does not exist, this recommendation is not applicable. If the file exists, run the command chmod 644 <path> to set the file permissions to 644."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-05-25 20:49:45 +02:00
file = $( get_service_file docker.service)
2018-01-16 13:46:49 +01:00
if [ -f " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a " $file " ) " -le 644 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_3( ) {
2021-03-09 11:42:48 +01:00
local id = "3.3"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that docker.socket file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "Find out the file location: systemctl show -p FragmentPath docker.socket. If the file does not exist, this recommendation is not applicable. If the file exists, run the command chown root:root <path> to set the ownership and group ownership for the file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-05-25 20:49:45 +02:00
file = $( get_service_file docker.socket)
2018-01-16 13:46:49 +01:00
if [ -f " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %u%g " $file " ) " -eq 00 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_4( ) {
2021-03-09 11:42:48 +01:00
local id = "3.4"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that docker.socket file permissions are set to 644 or more restrictive (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "Find out the file location: systemctl show -p FragmentPath docker.socket. If the file does not exist, this recommendation is not applicable. If the file does exist, you should run the command chmod 644 <path> to set the file permissions to 644."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-05-25 20:49:45 +02:00
file = $( get_service_file docker.socket)
2018-01-16 13:46:49 +01:00
if [ -f " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a " $file " ) " -le 644 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_5( ) {
2021-03-09 11:42:48 +01:00
local id = "3.5"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the /etc/docker directory ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root /etc/docker. This sets the ownership and group ownership for the directory to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
directory = "/etc/docker"
if [ -d " $directory " ] ; then
if [ " $( stat -c %u%g $directory ) " -eq 00 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $directory "
logcheckresult "WARN" " Wrong ownership for $directory "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * Directory not found"
logcheckresult "INFO" "Directory not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_6( ) {
2021-03-09 11:42:48 +01:00
local id = "3.6"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that /etc/docker directory permissions are set to 755 or more restrictively (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 755 /etc/docker. This sets the permissions for the directory to 755."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
directory = "/etc/docker"
if [ -d " $directory " ] ; then
2021-01-15 12:20:59 +01:00
if [ " $( stat -c %a $directory ) " -le 755 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $directory "
logcheckresult "WARN" " Wrong permissions for $directory "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * Directory not found"
logcheckresult "INFO" "Directory not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_7( ) {
2021-03-09 11:42:48 +01:00
local id = "3.7"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that registry certificate file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root /etc/docker/certs.d/<registry-name>/*. This would set the individual ownership and group ownership for the registry certificate files to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
directory = "/etc/docker/certs.d/"
if [ -d " $directory " ] ; then
fail = 0
owners = $( find " $directory " -type f -name '*.crt' )
for p in $owners ; do
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %u " $p " ) " -ne 0 ] ; then
2018-01-16 13:46:49 +01:00
fail = 1
fi
done
if [ $fail -eq 1 ] ; then
2021-03-16 09:05:49 +01:00
warn -s " $check "
2018-01-16 13:46:49 +01:00
warn " * Wrong ownership for $directory "
2021-03-16 09:05:49 +01:00
logcheckresult "WARN" " Wrong ownership for $directory "
2021-03-29 14:22:14 +02:00
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
pass -s " $check "
logcheckresult "PASS"
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * Directory not found"
logcheckresult "INFO" "Directory not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_8( ) {
2021-03-09 11:42:48 +01:00
local id = "3.8"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that registry certificate file permissions are set to 444 or more restrictively (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 444 /etc/docker/certs.d/<registry-name>/*. This would set the permissions for the registry certificate files to 444."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
directory = "/etc/docker/certs.d/"
if [ -d " $directory " ] ; then
fail = 0
perms = $( find " $directory " -type f -name '*.crt' )
for p in $perms ; do
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a " $p " ) " -gt 444 ] ; then
2018-01-16 13:46:49 +01:00
fail = 1
fi
done
if [ $fail -eq 1 ] ; then
2021-03-16 09:05:49 +01:00
warn -s " $check "
2018-01-16 13:46:49 +01:00
warn " * Wrong permissions for $directory "
2021-03-16 09:05:49 +01:00
logcheckresult "WARN" " Wrong permissions for $directory "
2021-03-29 14:22:14 +02:00
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
pass -s " $check "
logcheckresult "PASS"
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * Directory not found"
logcheckresult "INFO" "Directory not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_9( ) {
2021-03-09 11:42:48 +01:00
local id = "3.9"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that TLS CA certificate file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root <path to TLS CA certificate file>. This sets the individual ownership and group ownership for the TLS CA certificate file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-03-29 14:22:14 +02:00
tlscacert = $( get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
2019-10-16 09:49:18 +02:00
if [ -n " $( get_docker_configuration_file_args 'tlscacert' ) " ] ; then
2018-01-16 13:46:49 +01:00
tlscacert = $( get_docker_configuration_file_args 'tlscacert' )
2015-05-11 06:08:28 +02:00
fi
2018-01-16 13:46:49 +01:00
if [ -f " $tlscacert " ] ; then
if [ " $( stat -c %u%g " $tlscacert " ) " -eq 00 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $tlscacert "
logcheckresult "WARN" " Wrong ownership for $tlscacert "
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * No TLS CA certificate found"
logcheckresult "INFO" "No TLS CA certificate found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_10( ) {
2021-03-09 11:42:48 +01:00
local id = "3.10"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that TLS CA certificate file permissions are set to 444 or more restrictively (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 444 <path to TLS CA certificate file>. This sets the file permissions on the TLS CA file to 444."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-03-29 14:22:14 +02:00
tlscacert = $( get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
2019-10-16 09:49:18 +02:00
if [ -n " $( get_docker_configuration_file_args 'tlscacert' ) " ] ; then
2018-01-16 13:46:49 +01:00
tlscacert = $( get_docker_configuration_file_args 'tlscacert' )
fi
if [ -f " $tlscacert " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a " $tlscacert " ) " -le 444 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $tlscacert "
logcheckresult "WARN" " Wrong permissions for $tlscacert "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * No TLS CA certificate found"
logcheckresult "INFO" "No TLS CA certificate found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_11( ) {
2021-03-09 11:42:48 +01:00
local id = "3.11"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that Docker server certificate file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root <path to Docker server certificate file>. This sets the individual ownership and the group ownership for the Docker server certificate file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-03-29 14:22:14 +02:00
tlscert = $( get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
2019-10-16 09:49:18 +02:00
if [ -n " $( get_docker_configuration_file_args 'tlscert' ) " ] ; then
2018-01-16 13:46:49 +01:00
tlscert = $( get_docker_configuration_file_args 'tlscert' )
fi
if [ -f " $tlscert " ] ; then
if [ " $( stat -c %u%g " $tlscert " ) " -eq 00 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $tlscert "
logcheckresult "WARN" " Wrong ownership for $tlscert "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * No TLS Server certificate found"
logcheckresult "INFO" "No TLS Server certificate found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_12( ) {
2021-03-09 11:42:48 +01:00
local id = "3.12"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the Docker server certificate file permissions are set to 444 or more restrictively (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 444 <path to Docker server certificate file>. This sets the file permissions of the Docker server certificate file to 444."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-03-29 14:22:14 +02:00
tlscert = $( get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
2019-10-16 09:49:18 +02:00
if [ -n " $( get_docker_configuration_file_args 'tlscert' ) " ] ; then
2018-01-16 13:46:49 +01:00
tlscert = $( get_docker_configuration_file_args 'tlscert' )
2015-05-11 06:08:28 +02:00
fi
2018-01-16 13:46:49 +01:00
if [ -f " $tlscert " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a " $tlscert " ) " -le 444 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $tlscert "
logcheckresult "WARN" " Wrong permissions for $tlscert "
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * No TLS Server certificate found"
logcheckresult "INFO" "No TLS Server certificate found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_13( ) {
2021-03-09 11:42:48 +01:00
local id = "3.13"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the Docker server certificate key file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root <path to Docker server certificate key file>. This sets the individual ownership and group ownership for the Docker server certificate key file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-03-29 14:22:14 +02:00
tlskey = $( get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
2019-10-16 09:49:18 +02:00
if [ -n " $( get_docker_configuration_file_args 'tlskey' ) " ] ; then
2018-01-16 13:46:49 +01:00
tlskey = $( get_docker_configuration_file_args 'tlskey' )
fi
if [ -f " $tlskey " ] ; then
if [ " $( stat -c %u%g " $tlskey " ) " -eq 00 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $tlskey "
logcheckresult "WARN" " Wrong ownership for $tlskey "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * No TLS Key found"
logcheckresult "INFO" "No TLS Key found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_14( ) {
2021-03-09 11:42:48 +01:00
local id = "3.14"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the Docker server certificate key file permissions are set to 400 (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 400 <path to Docker server certificate key file>. This sets the Docker server certificate key file permissions to 400."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-03-29 14:22:14 +02:00
tlskey = $( get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
2019-10-16 09:49:18 +02:00
if [ -n " $( get_docker_configuration_file_args 'tlskey' ) " ] ; then
2018-01-16 13:46:49 +01:00
tlskey = $( get_docker_configuration_file_args 'tlskey' )
2015-05-11 06:08:28 +02:00
fi
2018-01-16 13:46:49 +01:00
if [ -f " $tlskey " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a " $tlskey " ) " -eq 400 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $tlskey "
logcheckresult "WARN" " Wrong permissions for $tlskey "
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * No TLS Key found"
logcheckresult "INFO" "No TLS Key found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_15( ) {
2021-03-09 11:42:48 +01:00
local id = "3.15"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the Docker socket file ownership is set to root:docker (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:docker /var/run/docker.sock. This sets the ownership to root and group ownership to docker for the default Docker socket file."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
file = "/var/run/docker.sock"
if [ -S " $file " ] ; then
if [ " $( stat -c %U:%G $file ) " = 'root:docker' ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2015-05-11 06:08:28 +02:00
2018-01-16 13:46:49 +01:00
check_3_16( ) {
2021-03-09 11:42:48 +01:00
local id = "3.16"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the Docker socket file permissions are set to 660 or more restrictively (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 660 /var/run/docker.sock. This sets the file permissions of the Docker socket file to 660."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
file = "/var/run/docker.sock"
if [ -S " $file " ] ; then
2021-01-15 12:20:59 +01:00
if [ " $( stat -c %a $file ) " -le 660 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
return
2016-04-14 22:57:25 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2016-04-14 22:57:25 +02:00
2018-01-16 13:46:49 +01:00
check_3_17( ) {
2021-03-09 11:42:48 +01:00
local id = "3.17"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the daemon.json file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root /etc/docker/daemon.json. This sets the ownership and group ownership for the file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
file = "/etc/docker/daemon.json"
if [ -f " $file " ] ; then
if [ " $( stat -c %U:%G $file ) " = 'root:root' ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
return
2016-04-14 22:57:25 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2016-04-14 22:57:25 +02:00
2018-01-16 13:46:49 +01:00
check_3_18( ) {
2021-03-09 11:42:48 +01:00
local id = "3.18"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that daemon.json file permissions are set to 644 or more restrictive (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chmod 644 /etc/docker/daemon.json. This sets the file permissions for this file to 644."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
file = "/etc/docker/daemon.json"
if [ -f " $file " ] ; then
2021-01-15 12:20:59 +01:00
if [ " $( stat -c %a $file ) " -le 644 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
return
2016-04-14 22:57:25 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2016-04-14 22:57:25 +02:00
2018-01-16 13:46:49 +01:00
check_3_19( ) {
2021-03-09 11:42:48 +01:00
local id = "3.19"
2021-05-25 20:49:45 +02:00
local desc = "Ensure that the /etc/default/docker file ownership is set to root:root (Automated)"
2021-03-22 08:43:56 +01:00
local remediation = "You should run the following command: chown root:root /etc/default/docker. This sets the ownership and group ownership of the file to root."
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2018-01-16 13:46:49 +01:00
file = "/etc/default/docker"
if [ -f " $file " ] ; then
if [ " $( stat -c %U:%G $file ) " = 'root:root' ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
return
2016-04-14 22:57:25 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
2016-04-14 22:57:25 +02:00
2018-01-16 13:46:49 +01:00
check_3_20( ) {
2021-03-09 11:42:48 +01:00
local id = "3.20"
2023-03-06 12:59:56 +01:00
local desc = "Ensure that the /etc/default/docker file permissions are set to 644 or more restrictively (Automated)"
local remediation = "You should run the following command: chmod 644 /etc/default/docker. This sets the file permissions for this file to 644."
2021-03-22 08:43:56 +01:00
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2023-03-06 12:59:56 +01:00
file = "/etc/default/docker"
2018-01-16 13:46:49 +01:00
if [ -f " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a $file ) " -le 644 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2019-08-27 15:13:19 +02:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
2021-05-25 20:49:45 +02:00
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
2021-03-29 14:22:14 +02:00
return
2019-08-27 15:13:19 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2019-08-27 15:13:19 +02:00
}
check_3_21( ) {
2021-03-09 11:42:48 +01:00
local id = "3.21"
2023-03-06 12:59:56 +01:00
local desc = "Ensure that the /etc/sysconfig/docker file permissions are set to 644 or more restrictively (Automated)"
local remediation = "You should run the following command: chmod 644 /etc/sysconfig/docker. This sets the file permissions for this file to 644."
2021-03-22 08:43:56 +01:00
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
2019-08-27 15:13:19 +02:00
2019-10-04 14:50:48 +02:00
file = "/etc/sysconfig/docker"
2019-08-27 15:13:19 +02:00
if [ -f " $file " ] ; then
2023-03-06 12:59:56 +01:00
if [ " $( stat -c %a $file ) " -le 644 ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2018-01-16 13:46:49 +01:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
2023-03-06 12:59:56 +01:00
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
2021-03-29 14:22:14 +02:00
return
2019-08-27 15:13:19 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2019-08-27 15:13:19 +02:00
}
check_3_22( ) {
2021-03-09 11:42:48 +01:00
local id = "3.22"
2023-03-06 12:59:56 +01:00
local desc = "Ensure that the /etc/sysconfig/docker file ownership is set to root:root (Automated)"
local remediation = "You should run the following command: chown root:root /etc/sysconfig/docker. This sets the ownership and group ownership for the file to root."
2021-03-22 08:43:56 +01:00
local remediationImpact = "None."
2021-05-25 20:49:45 +02:00
local check = " $id - $desc "
2021-03-09 11:42:48 +01:00
starttestjson " $id " " $desc "
2019-08-27 15:13:19 +02:00
2023-03-06 12:59:56 +01:00
file = "/etc/sysconfig/docker"
2019-08-27 15:13:19 +02:00
if [ -f " $file " ] ; then
2023-03-06 12:59:56 +01:00
if [ " $( stat -c %U:%G $file ) " = 'root:root' ] ; then
2021-03-16 09:05:49 +01:00
pass -s " $check "
logcheckresult "PASS"
2021-03-29 14:22:14 +02:00
return
2019-08-27 15:13:19 +02:00
fi
2021-03-29 14:22:14 +02:00
warn -s " $check "
2023-03-06 12:59:56 +01:00
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
2021-03-29 14:22:14 +02:00
return
2015-05-11 06:08:28 +02:00
fi
2021-03-29 14:22:14 +02:00
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
2018-01-16 13:46:49 +01:00
}
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
2021-05-25 20:49:45 +02:00
check_3_23( ) {
local id = "3.23"
local desc = "Ensure that the Containerd socket file ownership is set to root:root (Automated)"
local remediation = "You should run the following command: chown root:root /run/containerd/containerd.sock. This sets the ownership and group ownership for the file to root."
local remediationImpact = "None."
local check = " $id - $desc "
starttestjson " $id " " $desc "
file = "/run/containerd/containerd.sock"
2021-07-12 15:22:12 +02:00
if [ -S " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %U:%G $file ) " = 'root:root' ] ; then
pass -s " $check "
logcheckresult "PASS"
return
fi
warn -s " $check "
warn " * Wrong ownership for $file "
logcheckresult "WARN" " Wrong ownership for $file "
return
fi
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
}
check_3_24( ) {
local id = "3.24"
local desc = "Ensure that the Containerd socket file permissions are set to 660 or more restrictively (Automated)"
local remediation = "You should run the following command: chmod 660 /run/containerd/containerd.sock. This sets the file permissions for this file to 660."
local remediationImpact = "None."
local check = " $id - $desc "
starttestjson " $id " " $desc "
file = "/run/containerd/containerd.sock"
2021-07-12 15:22:12 +02:00
if [ -S " $file " ] ; then
2021-05-25 20:49:45 +02:00
if [ " $( stat -c %a $file ) " -le 660 ] ; then
pass -s " $check "
logcheckresult "PASS"
return
fi
warn -s " $check "
warn " * Wrong permissions for $file "
logcheckresult "WARN" " Wrong permissions for $file "
return
fi
info -c " $check "
info " * File not found"
logcheckresult "INFO" "File not found"
}
Improve docker-bench-security json output
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.
Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.
Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.
All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2018-07-12 03:02:12 +02:00
check_3_end( ) {
endsectionjson
}
