GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Make ifs style be consistent

Browse source
This commit is contained in:
Diogo Monica 2015-05-14 20:26:32 -07:00
parent d6c1443641
commit 03ac3f5bd3
6 changed files with 27 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docker_security_benchmark.sh
View file

@ -54,7 +54,7 @@ logit "Initializing `date`\n"
# Warn if not root # Warn if not root
ID=`id -u` ID=`id -u`
if test "x$ID" != "x0"; then if [ "x$ID" != "x0" ]; then
warn "Some tests might require root to run" warn "Some tests might require root to run"
sleep 3 sleep 3
fi fi

2
helper_lib.sh
View file

@ -29,7 +29,7 @@ do_version_check() {
contains() { contains() {
string="$1" string="$1"
substring="$2" substring="$2"
if test "${string#*$substring}" != "$string" if [ "${string#*$substring}" != "$string" ]
then then
return 0 # $substring is in $string return 0 # $substring is in $string
else else

10
tests/3_docker_daemon_configuration_files.sh
View file

@ -291,7 +291,7 @@ if [ -d "$directory" ]; then
fail=0 fail=0
perms=`ls -lL $directory/* | grep .crt | awk '{print $1}'` perms=`ls -lL $directory/* | grep .crt | awk '{print $1}'`
for p in $perms; do for p in $perms; do
if test "$p" != "-rw-r--r--." && test "$p" = "-rw-------."; then if [ "$p" != "-rw-r--r--." -a "$p" = "-rw-------." ]; then
fail=1 fail=1
fi fi
done done
@ -327,7 +327,7 @@ check_3_20="3.20 - Verify that TLS CA certificate file permissions are set to 44
tlscacert=`ps -ef | grep docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1` tlscacert=`ps -ef | grep docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1`
if [ -f "$tlscacert" ]; then if [ -f "$tlscacert" ]; then
perms=`ls -ld "$tlscacert" | awk '{print $1}'` perms=`ls -ld "$tlscacert" | awk '{print $1}'`
if test "$perms" = "-rw-r--r--"; then if [ "$perms" = "-rw-r--r--" ]; then
pass "$check_3_20" pass "$check_3_20"
else else
warn "$check_3_20" warn "$check_3_20"
@ -359,7 +359,7 @@ check_3_22="3.22 - Verify that Docker server certificate file permissions are se
tlscacert=`ps -ef | grep docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1` tlscacert=`ps -ef | grep docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1`
if [ -f "$tlscert" ]; then if [ -f "$tlscert" ]; then
perms=`ls -ld "$tlscert" | awk '{print $1}'` perms=`ls -ld "$tlscert" | awk '{print $1}'`
if test "$perms" = "-rw-r--r--"; then if [ "$perms" = "-rw-r--r--" ]; then
pass "$check_3_22" pass "$check_3_22"
else else
warn "$check_3_22" warn "$check_3_22"
@ -391,7 +391,7 @@ check_3_24="3.24 - Verify that Docker server key file permissions are set to 400
tlskey=`ps -ef | grep docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1` tlskey=`ps -ef | grep docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1`
if [ -f "$tlskey" ]; then if [ -f "$tlskey" ]; then
perms=`ls -ld "$tlskey" | awk '{print $1}'` perms=`ls -ld "$tlskey" | awk '{print $1}'`
if test "$perms" = "-r--------"; then if [ "$perms" = "-r--------" ]; then
pass "$check_3_24" pass "$check_3_24"
else else
warn "$check_3_24" warn "$check_3_24"
@ -423,7 +423,7 @@ check_3_26="3.26 - Verify that Docker socket file permissions are set to 660"
file="/var/run/docker.sock" file="/var/run/docker.sock"
if [ -f "$file" ]; then if [ -f "$file" ]; then
perms=`ls -ld "$file" | awk '{print $1}'` perms=`ls -ld "$file" | awk '{print $1}'`
if test "$perms" = "srw-rw----"; then if [ "$perms" = "srw-rw----" ]; then
pass "$check_3_26" pass "$check_3_26"
else else
warn "$check_3_26" warn "$check_3_26"

4
tests/4_container_images.sh
View file

@ -7,7 +7,7 @@ info "4 - Container Images and Build Files"
check_4_1="4.1 - Create a user for the container" check_4_1="4.1 - Create a user for the container"
# If container_users is empty, there are no running containers # If container_users is empty, there are no running containers
if test "$containers" = ""; then if [ -z "$containers" ]; then
info "$check_4_1" info "$check_4_1"
info " * No containers running" info " * No containers running"
else else
@ -19,7 +19,7 @@ else
for c in $containers; do for c in $containers; do
user=`docker inspect --format 'User={{.Config.User}}' $c` user=`docker inspect --format 'User={{.Config.User}}' $c`
if test $user = "User=" || test $user = "User=[]" || test $user = "User=<no value>"; then if [ "$user" = "User=" -o "$user" = "User=[]" -o "$user" = "User=<no value>" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_4_1" warn "$check_4_1"

32
tests/5_container_runtime.sh
View file

@ -4,7 +4,7 @@ logit "\n"
info "5 - Container Runtime" info "5 - Container Runtime"
# If containers is empty, there are no running containers # If containers is empty, there are no running containers
if test "$containers" = ""; then if [ -z "$containers" ]; then
info " * No containers running, skipping Section 5" info " * No containers running, skipping Section 5"
else else
# Make the loop separator be a new-line in POSIX compliant fashion # Make the loop separator be a new-line in POSIX compliant fashion
@ -17,7 +17,7 @@ else
for c in $containers; do for c in $containers; do
policy=`docker inspect --format 'AppArmorProfile={{ .AppArmorProfile }}' $c` policy=`docker inspect --format 'AppArmorProfile={{ .AppArmorProfile }}' $c`
if test $policy = "AppArmorProfile=" || test $policy = "AppArmorProfile=[]" ||test $policy = "AppArmorProfile=<no value>"; then if [ "$policy" = "AppArmorProfile=" -o "$policy" = "AppArmorProfile=[]" -o "$policy" = "AppArmorProfile=<no value>" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_1" warn "$check_5_1"
@ -40,7 +40,7 @@ else
for c in $containers; do for c in $containers; do
policy=`docker inspect --format 'SecurityOpt={{ .HostConfig.SecurityOpt }}' $c` policy=`docker inspect --format 'SecurityOpt={{ .HostConfig.SecurityOpt }}' $c`
if test $policy = "SecurityOpt=" || test $policy = "SecurityOpt=[]" || test $policy = "SecurityOpt=<no value>"; then if [ "$policy" = "SecurityOpt=" -o "$policy" = "SecurityOpt=[]" -o "$policy" = "SecurityOpt=<no value>" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_2" warn "$check_5_2"
@ -85,7 +85,7 @@ else
for c in $containers; do for c in $containers; do
caps=`docker inspect --format 'CapAdd={{ .HostConfig.CapAdd}}' $c` caps=`docker inspect --format 'CapAdd={{ .HostConfig.CapAdd}}' $c`
if test $caps != "CapAdd=" && test $caps != "CapAdd=[]" && test $caps != "CapAdd=<no value>"; then if [ "$caps" != "CapAdd=" -a "$caps" != "CapAdd=[]" -a "$caps" != "CapAdd=<no value>" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_4" warn "$check_5_4"
@ -108,7 +108,7 @@ else
for c in $containers; do for c in $containers; do
privileged=`docker inspect --format '{{ .HostConfig.Privileged }}' $c` privileged=`docker inspect --format '{{ .HostConfig.Privileged }}' $c`
if test $privileged = "true"; then if [ "$privileged" = "true" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_5" warn "$check_5_5"
@ -190,7 +190,7 @@ else
for c in $containers; do for c in $containers; do
port=`docker port $c | awk '{print $1}' | cut -d '/' -f1` port=`docker port $c | awk '{print $1}' | cut -d '/' -f1`
if test "$port" != "" && [ $port -lt 1025 ]; then if [ ! -z "$port" ] && [ $port -lt 1025 ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_8" warn "$check_5_8"
@ -213,7 +213,7 @@ else
for c in $containers; do for c in $containers; do
mode=`docker inspect --format 'NetworkMode={{ .HostConfig.NetworkMode }}' $c` mode=`docker inspect --format 'NetworkMode={{ .HostConfig.NetworkMode }}' $c`
if test $mode = "NetworkMode=host"; then if [ "$mode" = "NetworkMode=host" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_10" warn "$check_5_10"
@ -236,7 +236,7 @@ else
for c in $containers; do for c in $containers; do
memory=`docker inspect --format '{{ .Config.Memory }}' $c` memory=`docker inspect --format '{{ .Config.Memory }}' $c`
if test $memory = "0"; then if [ $memory = "0" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_11" warn "$check_5_11"
@ -259,7 +259,7 @@ else
for c in $containers; do for c in $containers; do
shares=`docker inspect --format '{{ .Config.CpuShares }}' $c` shares=`docker inspect --format '{{ .Config.CpuShares }}' $c`
if test $shares = "0"; then if [ "$shares" = "0" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_12" warn "$check_5_12"
@ -282,7 +282,7 @@ else
for c in $containers; do for c in $containers; do
read_status=`docker inspect --format '{{ .HostConfig.ReadonlyRootfs }}' $c` read_status=`docker inspect --format '{{ .HostConfig.ReadonlyRootfs }}' $c`
if test $read_status = "false"; then if [ "$read_status" = "false" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_13" warn "$check_5_13"
@ -304,7 +304,7 @@ else
fail=0 fail=0
for c in $containers; do for c in $containers; do
ip=`docker port $c | awk '{print $3}' | cut -d ':' -f1` ip=`docker port $c | awk '{print $3}' | cut -d ':' -f1`
if test "$ip" = "0.0.0.0"; then if [ "$ip" = "0.0.0.0" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_14" warn "$check_5_14"
@ -327,7 +327,7 @@ else
for c in $containers; do for c in $containers; do
policy=`docker inspect --format 'RestartPolicyName={{ .HostConfig.RestartPolicy.Name }}' $c` policy=`docker inspect --format 'RestartPolicyName={{ .HostConfig.RestartPolicy.Name }}' $c`
if test $policy = "RestartPolicyName=always"; then if [ "$policy" = "RestartPolicyName=always" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_15" warn "$check_5_15"
@ -350,7 +350,7 @@ else
for c in $containers; do for c in $containers; do
mode=`docker inspect --format 'PidMode={{.HostConfig.PidMode }}' $c` mode=`docker inspect --format 'PidMode={{.HostConfig.PidMode }}' $c`
if test $mode = "PidMode=host"; then if [ "$mode" = "PidMode=host" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_16" warn "$check_5_16"
@ -373,7 +373,7 @@ else
for c in $containers; do for c in $containers; do
mode=`docker inspect --format 'IpcMode={{.HostConfig.IpcMode }}' $c` mode=`docker inspect --format 'IpcMode={{.HostConfig.IpcMode }}' $c`
if test $mode = "IpcMode=host"; then if [ "$mode" = "IpcMode=host" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
warn "$check_5_17" warn "$check_5_17"
@ -396,7 +396,7 @@ else
for c in $containers; do for c in $containers; do
devices=`docker inspect --format 'Devices={{ .HostConfig.Devices }}' $c` devices=`docker inspect --format 'Devices={{ .HostConfig.Devices }}' $c`
if test $devices != "Devices=" && test $devices != "Devices=[]" && test $devices != "Devices=<no value>"; then if [ "$devices" != "Devices=" -a "$devices" != "Devices=[]" -a "$devices" != "Devices=<no value>" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
info "$check_5_18" info "$check_5_18"
@ -420,7 +420,7 @@ else
for c in $containers; do for c in $containers; do
ulimits=`docker inspect --format 'Ulimits={{ .HostConfig.Ulimits }}' $c` ulimits=`docker inspect --format 'Ulimits={{ .HostConfig.Ulimits }}' $c`
if test $ulimits = "Ulimits=" || test $ulimits = "Ulimits=[]" || test $ulimits = "Ulimits=<no value>"; then if [ "$ulimits" = "Ulimits=" -o "$ulimits" = "Ulimits=[]" -o "$ulimits" = "Ulimits=<no value>" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
info "$check_5_19" info "$check_5_19"

4
tests/6_docker_security_operations.sh
View file

@ -7,7 +7,7 @@ info "6 - Docker Security Operations"
check_6_5="6.5 - Use a centralized and remote log collection service" check_6_5="6.5 - Use a centralized and remote log collection service"
# If containers is empty, there are no running containers # If containers is empty, there are no running containers
if test "$containers" = ""; then if [ -z "$containers" ]; then
info "$check_6_5" info "$check_6_5"
info " * No containers running" info " * No containers running"
else else
@ -17,7 +17,7 @@ else
for c in $containers; do for c in $containers; do
volumes=`docker inspect --format '{{ .Volumes }}' $c` volumes=`docker inspect --format '{{ .Volumes }}' $c`
if test $volumes = "map[]"; then if [ "$volumes" = "map[]" ]; then
# If it's the first container, fail the test # If it's the first container, fail the test
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
info "$check_6_5" info "$check_6_5"