GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 08:42:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Some Docker daemon configuration vulnerabilities (secion 2) does not work in ubuntu

Browse source 
Apparently in ubuntu pgrep -lf docker does not return the docker process
input parameter.
Thus, all the test that validate command line parameter (e.g., tls
setup, ulimits) does not work.
After replacing pgrep with ps ax all checks are working correctly.

Tested on:
Kernetl version: 3.16.0-37-generic
Ubuntu version: 14.04.1-Ubuntu

Signed-off-by: liron-l <levinlir@gmail.com>
This commit is contained in:
Liron Levin 2015-06-22 16:55:19 +03:00
parent 62a903246c
commit 09cf68d8e8
1 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
tests/2_docker_daemon_configuration.sh
View file

@ -5,7 +5,7 @@ info "2 - Docker Daemon Configuration"
# 2.1 # 2.1
check_2_1="2.1 - Do not use lxc execution driver" check_2_1="2.1 - Do not use lxc execution driver"
pgrep -lf docker | grep lxc >/dev/null 2>&1 ps ax | grep "docker" | grep lxc >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_1" warn "$check_2_1"
else else
@ -14,7 +14,7 @@ fi
# 2.2 # 2.2
check_2_2="2.2 - Restrict network traffic between containers" check_2_2="2.2 - Restrict network traffic between containers"
pgrep -lf docker | grep "icc=false" >/dev/null 2>&1 ps ax | grep "docker" | grep "icc=false" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_2" pass "$check_2_2"
else else
@ -23,7 +23,7 @@ fi
# 2.3 # 2.3
check_2_3="2.3 - Set the logging level" check_2_3="2.3 - Set the logging level"
pgrep -lf docker | grep "log-level=\"debug\"" >/dev/null 2>&1 ps ax | grep "docker" | grep "log-level=\"debug\"" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_3" warn "$check_2_3"
else else
@ -32,7 +32,7 @@ fi
# 2.4 # 2.4
check_2_4="2.4 - Allow Docker to make changes to iptables" check_2_4="2.4 - Allow Docker to make changes to iptables"
pgrep -lf docker | grep "iptables=false" >/dev/null 2>&1 ps ax | grep "docker" | grep "iptables=false" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_4" warn "$check_2_4"
else else
@ -41,7 +41,7 @@ fi
# 2.5 # 2.5
check_2_5="2.5 - Do not use insecure registries" check_2_5="2.5 - Do not use insecure registries"
pgrep -lf docker | grep "insecure-registry" >/dev/null 2>&1 ps ax | grep "docker" | grep "insecure-registry" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_5" warn "$check_2_5"
else else
@ -50,7 +50,7 @@ fi
# 2.6 # 2.6
check_2_6="2.6 - Setup a local registry mirror" check_2_6="2.6 - Setup a local registry mirror"
pgrep -lf docker | grep "registry-mirror" >/dev/null 2>&1 ps ax | grep "docker" | grep "registry-mirror" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_6" pass "$check_2_6"
else else
@ -69,7 +69,7 @@ fi
# 2.8 # 2.8
check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket"
pgrep -lf docker | grep "\-H" >/dev/null 2>&1 ps ax | grep "docker" | grep "\-H" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
info "$check_2_8" info "$check_2_8"
info " * Docker daemon running with -H" info " * Docker daemon running with -H"
@ -79,9 +79,9 @@ fi
# 2.9 # 2.9
check_2_9="2.9 - Configure TLS authentication for Docker daemon" check_2_9="2.9 - Configure TLS authentication for Docker daemon"
pgrep -lf docker | grep "\-H" >/dev/null 2>&1 ps ax | grep "docker" | grep "\-H" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pgrep -lf docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 ps uax | grep "docker" | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_9" pass "$check_2_9"
info " * Docker daemon currently listening on TCP" info " * Docker daemon currently listening on TCP"
@ -96,7 +96,7 @@ fi
# 2.10 # 2.10
check_2_10="2.10 - Set default ulimit as appropriate" check_2_10="2.10 - Set default ulimit as appropriate"
pgrep -lf docker | grep "default-ulimit" >/dev/null 2>&1 ps ax | grep "docker" | grep "default-ulimit" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_10" pass "$check_2_10"
else else