GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2024-11-01 08:31:44 +01:00
Code Issues Projects Releases Packages Wiki Activity

Make ifs style be consistent

Browse source
This commit is contained in:
Diogo Monica 2015-05-14 20:26:32 -07:00
parent d6c1443641
commit 03ac3f5bd3
6 changed files with 27 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docker_security_benchmark.sh
View file

@ -54,7 +54,7 @@ logit "Initializing `date`\n"
# Warn if not root
ID=`id -u`
if test "x$ID" != "x0"; then
if [ "x$ID" != "x0" ]; then
warn "Some tests might require root to run"
sleep 3
fi

2
helper_lib.sh
View file

@ -29,7 +29,7 @@ do_version_check() {
contains() {
string="$1"
substring="$2"
if test "${string#*$substring}" != "$string"
if [ "${string#*$substring}" != "$string" ]
then
return 0 # $substring is in $string
else

10
tests/3_docker_daemon_configuration_files.sh
View file

@ -291,7 +291,7 @@ if [ -d "$directory" ]; then
fail=0
perms=`ls -lL $directory/* | grep .crt | awk '{print $1}'`
for p in $perms; do
if test "$p" != "-rw-r--r--." && test "$p" = "-rw-------."; then
if [ "$p" != "-rw-r--r--." -a "$p" = "-rw-------." ]; then
fail=1
fi
done
@ -327,7 +327,7 @@ check_3_20="3.20 - Verify that TLS CA certificate file permissions are set to 44
tlscacert=`ps -ef | grep docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1`
if [ -f "$tlscacert" ]; then
perms=`ls -ld "$tlscacert" | awk '{print $1}'`
if test "$perms" = "-rw-r--r--"; then
if [ "$perms" = "-rw-r--r--" ]; then
pass "$check_3_20"
else
warn "$check_3_20"
@ -359,7 +359,7 @@ check_3_22="3.22 - Verify that Docker server certificate file permissions are se
tlscacert=`ps -ef | grep docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1`
if [ -f "$tlscert" ]; then
perms=`ls -ld "$tlscert" | awk '{print $1}'`
if test "$perms" = "-rw-r--r--"; then
if [ "$perms" = "-rw-r--r--" ]; then
pass "$check_3_22"
else
warn "$check_3_22"
@ -391,7 +391,7 @@ check_3_24="3.24 - Verify that Docker server key file permissions are set to 400
tlskey=`ps -ef | grep docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1`
if [ -f "$tlskey" ]; then
perms=`ls -ld "$tlskey" | awk '{print $1}'`
if test "$perms" = "-r--------"; then
if [ "$perms" = "-r--------" ]; then
pass "$check_3_24"
else
warn "$check_3_24"
@ -423,7 +423,7 @@ check_3_26="3.26 - Verify that Docker socket file permissions are set to 660"
file="/var/run/docker.sock"
if [ -f "$file" ]; then
perms=`ls -ld "$file" | awk '{print $1}'`
if test "$perms" = "srw-rw----"; then
if [ "$perms" = "srw-rw----" ]; then
pass "$check_3_26"
else
warn "$check_3_26"

4
tests/4_container_images.sh
View file

@ -7,7 +7,7 @@ info "4 - Container Images and Build Files"
check_4_1="4.1 - Create a user for the container"
# If container_users is empty, there are no running containers
if test "$containers" = ""; then
if [ -z "$containers" ]; then
info "$check_4_1"
info " * No containers running"
else
@ -19,7 +19,7 @@ else
for c in $containers; do
user=`docker inspect --format 'User={{.Config.User}}' $c`
if test $user = "User=" || test $user = "User=[]" || test $user = "User=<no value>"; then
if [ "$user" = "User=" -o "$user" = "User=[]" -o "$user" = "User=<no value>" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_4_1"

32
tests/5_container_runtime.sh
View file

@ -4,7 +4,7 @@ logit "\n"
info "5 - Container Runtime"
# If containers is empty, there are no running containers
if test "$containers" = ""; then
if [ -z "$containers" ]; then
info " * No containers running, skipping Section 5"
else
# Make the loop separator be a new-line in POSIX compliant fashion
@ -17,7 +17,7 @@ else
for c in $containers; do
policy=`docker inspect --format 'AppArmorProfile={{ .AppArmorProfile }}' $c`
if test $policy = "AppArmorProfile=" || test $policy = "AppArmorProfile=[]" ||test $policy = "AppArmorProfile=<no value>"; then
if [ "$policy" = "AppArmorProfile=" -o "$policy" = "AppArmorProfile=[]" -o "$policy" = "AppArmorProfile=<no value>" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_1"
@ -40,7 +40,7 @@ else
for c in $containers; do
policy=`docker inspect --format 'SecurityOpt={{ .HostConfig.SecurityOpt }}' $c`
if test $policy = "SecurityOpt=" || test $policy = "SecurityOpt=[]" || test $policy = "SecurityOpt=<no value>"; then
if [ "$policy" = "SecurityOpt=" -o "$policy" = "SecurityOpt=[]" -o "$policy" = "SecurityOpt=<no value>" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_2"
@ -85,7 +85,7 @@ else
for c in $containers; do
caps=`docker inspect --format 'CapAdd={{ .HostConfig.CapAdd}}' $c`
if test $caps != "CapAdd=" && test $caps != "CapAdd=[]" && test $caps != "CapAdd=<no value>"; then
if [ "$caps" != "CapAdd=" -a "$caps" != "CapAdd=[]" -a "$caps" != "CapAdd=<no value>" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_4"
@ -108,7 +108,7 @@ else
for c in $containers; do
privileged=`docker inspect --format '{{ .HostConfig.Privileged }}' $c`
if test $privileged = "true"; then
if [ "$privileged" = "true" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_5"
@ -190,7 +190,7 @@ else
for c in $containers; do
port=`docker port $c | awk '{print $1}' | cut -d '/' -f1`
if test "$port" != "" && [ $port -lt 1025 ]; then
if [ ! -z "$port" ] && [ $port -lt 1025 ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_8"
@ -213,7 +213,7 @@ else
for c in $containers; do
mode=`docker inspect --format 'NetworkMode={{ .HostConfig.NetworkMode }}' $c`
if test $mode = "NetworkMode=host"; then
if [ "$mode" = "NetworkMode=host" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_10"
@ -236,7 +236,7 @@ else
for c in $containers; do
memory=`docker inspect --format '{{ .Config.Memory }}' $c`
if test $memory = "0"; then
if [ $memory = "0" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_11"
@ -259,7 +259,7 @@ else
for c in $containers; do
shares=`docker inspect --format '{{ .Config.CpuShares }}' $c`
if test $shares = "0"; then
if [ "$shares" = "0" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_12"
@ -282,7 +282,7 @@ else
for c in $containers; do
read_status=`docker inspect --format '{{ .HostConfig.ReadonlyRootfs }}' $c`
if test $read_status = "false"; then
if [ "$read_status" = "false" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_13"
@ -304,7 +304,7 @@ else
fail=0
for c in $containers; do
ip=`docker port $c | awk '{print $3}' | cut -d ':' -f1`
if test "$ip" = "0.0.0.0"; then
if [ "$ip" = "0.0.0.0" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_14"
@ -327,7 +327,7 @@ else
for c in $containers; do
policy=`docker inspect --format 'RestartPolicyName={{ .HostConfig.RestartPolicy.Name }}' $c`
if test $policy = "RestartPolicyName=always"; then
if [ "$policy" = "RestartPolicyName=always" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_15"
@ -350,7 +350,7 @@ else
for c in $containers; do
mode=`docker inspect --format 'PidMode={{.HostConfig.PidMode }}' $c`
if test $mode = "PidMode=host"; then
if [ "$mode" = "PidMode=host" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_16"
@ -373,7 +373,7 @@ else
for c in $containers; do
mode=`docker inspect --format 'IpcMode={{.HostConfig.IpcMode }}' $c`
if test $mode = "IpcMode=host"; then
if [ "$mode" = "IpcMode=host" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn "$check_5_17"
@ -396,7 +396,7 @@ else
for c in $containers; do
devices=`docker inspect --format 'Devices={{ .HostConfig.Devices }}' $c`
if test $devices != "Devices=" && test $devices != "Devices=[]" && test $devices != "Devices=<no value>"; then
if [ "$devices" != "Devices=" -a "$devices" != "Devices=[]" -a "$devices" != "Devices=<no value>" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
info "$check_5_18"
@ -420,7 +420,7 @@ else
for c in $containers; do
ulimits=`docker inspect --format 'Ulimits={{ .HostConfig.Ulimits }}' $c`
if test $ulimits = "Ulimits=" || test $ulimits = "Ulimits=[]" || test $ulimits = "Ulimits=<no value>"; then
if [ "$ulimits" = "Ulimits=" -o "$ulimits" = "Ulimits=[]" -o "$ulimits" = "Ulimits=<no value>" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
info "$check_5_19"

4
tests/6_docker_security_operations.sh
View file

@ -7,7 +7,7 @@ info "6 - Docker Security Operations"
check_6_5="6.5 - Use a centralized and remote log collection service"
# If containers is empty, there are no running containers
if test "$containers" = ""; then
if [ -z "$containers" ]; then
info "$check_6_5"
info " * No containers running"
else
@ -17,7 +17,7 @@ else
for c in $containers; do
volumes=`docker inspect --format '{{ .Volumes }}' $c`
if test $volumes = "map[]"; then
if [ "$volumes" = "map[]" ]; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
info "$check_6_5"