GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-31 14:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

convert all tests to functions, add 't' argument, add functions_lib.sh

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2016-01-31 21:33:14 +01:00
parent cfa653d8d8
commit 0c4944dc50
9 changed files with 1072 additions and 693 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
docker-bench-security.sh
View file

@ -13,6 +13,7 @@
# Load dependencies # Load dependencies
. ./output_lib.sh . ./output_lib.sh
. ./helper_lib.sh . ./helper_lib.sh
. ./functions_lib.sh
# Setup the paths # Setup the paths
this_path=$(abspath "$0") ## Path of this file including filenamel this_path=$(abspath "$0") ## Path of this file including filenamel
@ -45,11 +46,12 @@ EOF
# Get the flags # Get the flags
# If you add an option here, please # If you add an option here, please
# remember to update usage() above. # remember to update usage() above.
while getopts hl: args while getopts hlt: args
do do
case $args in case $args in
h) usage; exit 0 ;; h) usage; exit 0 ;;
l) logger="$OPTARG" ;; l) logger="$OPTARG" ;;
t) tests="$OPTARG";;
*) usage; exit 1 ;; *) usage; exit 1 ;;
esac esac
done done
@ -97,3 +99,10 @@ main () {
} }
main "$@" main "$@"
if [ -z "$tests" ]; then
cis_checks
else
"$tests"
fi

122
functions_lib.sh Normal file
View file

@ -0,0 +1,122 @@
#!/bin/sh
host_configuration() {
check_1
check_1_1
check_1_2
check_1_5
check_1_6
check_1_7
check_1_8
check_1_9
check_1_10
check_1_11
check_1_12
check_1_13
check_1_14
check_1_15
check_1_16
check_1_17
check_1_18
}
docker_daemon_configuration() {
check_2
check_2_1
check_2_2
check_2_3
check_2_4
check_2_5
check_2_6
check_2_7
check_2_8
check_2_9
check_2_10
}
docker_daemon_files() {
check_3
check_3_1
check_3_2
check_3_3
check_3_4
check_3_5
check_3_6
check_3_7
check_3_8
check_3_9
check_3_10
check_3_11
check_3_12
check_3_13
check_3_14
check_3_15
check_3_16
check_3_17
check_3_18
check_3_19
check_3_20
check_3_21
check_3_22
check_3_23
check_3_24
check_3_25
check_3_26
}
container_images() {
check_4
check_4_1
}
container_runtime() {
check_5
check_running_containers
check_5_1
check_5_2
check_5_3
check_5_4
check_5_5
check_5_6
check_5_8
check_5_8
check_5_10
check_5_11
check_5_12
check_5_12
check_5_14
check_5_15
check_5_16
check_5_17
check_5_18
check_5_19
}
docker_security_operations() {
check_6
check_6_5
check_6_6
check_6_7
}
# CIS
cis() {
host_configuration
docker_daemon_configuration
docker_daemon_files
container_images
container_runtime
docker_security_operations
}
# Community contributed
community() {
check_community
check_community_1
}
# All
all() {
cis
community
}

150
tests/1_host_configuration.sh
View file

@ -1,277 +1,311 @@
#!/bin/sh #!/bin/sh
check_1() {
logit "" logit ""
info "1 - Host Configuration" info "1 - Host Configuration"
}
# 1.1 # 1.1
check_1_1="1.1 - Create a separate partition for containers" check_1_1() {
check_check_1_1="1.1 - Create a separate partition for containers"
grep /var/lib/docker /etc/fstab >/dev/null 2>&1 grep /var/lib/docker /etc/fstab >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_1" pass "$check_check_1_1"
else else
warn "$check_1_1" warn "$check_check_1_1"
fi fi
}
# 1.2 # 1.2
check_1_2="1.2 - Use an updated Linux Kernel" check_1_2() {
check_check_1_2="1.2 - Use an updated Linux Kernel"
kernel_version=$(uname -r | cut -d "-" -f 1) kernel_version=$(uname -r | cut -d "-" -f 1)
do_version_check 3.10 "$kernel_version" do_version_check 3.10 "$kernel_version"
if [ $? -eq 11 ]; then if [ $? -eq 11 ]; then
warn "$check_1_2" warn "$check_check_1_2"
else else
pass "$check_1_2" pass "$check_check_1_2"
fi fi
}
# 1.5 # 1.5
check_1_5="1.5 - Remove all non-essential services from the host - Network" check_1_5() {
check_check_1_5="1.5 - Remove all non-essential services from the host - Network"
# Check for listening network services. # Check for listening network services.
listening_services=$(netstat -na | grep -v tcp6 | grep -v unix | grep -c LISTEN) listening_services=$(netstat -na | grep -v tcp6 | grep -v unix | grep -c LISTEN)
if [ "$listening_services" -eq 0 ]; then if [ "$listening_services" -eq 0 ]; then
warn "1.5 - Failed to get listening services for check: $check_1_5" warn "1.5 - Failed to get listening services for check: $check_check_1_5"
else else
if [ "$listening_services" -gt 5 ]; then if [ "$listening_services" -gt 5 ]; then
warn "$check_1_5" warn "$check_check_1_5"
warn " * Host listening on: $listening_services ports" warn " * Host listening on: $listening_services ports"
else else
pass "$check_1_5" pass "$check_check_1_5"
fi fi
fi fi
}
# 1.6 # 1.6
check_1_6="1.6 - Keep Docker up to date" check_1_6() {
check_check_1_6="1.6 - Keep Docker up to date"
docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \ docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \
| awk '{print $NF; exit}' | tr -d '[:alpha:]-,') | awk '{print $NF; exit}' | tr -d '[:alpha:]-,')
docker_current_version="1.9.1" docker_current_version="1.9.1"
docker_current_date="2015-11-09" docker_current_date="2015-11-09"
do_version_check "$docker_current_version" "$docker_version" do_version_check "$docker_current_version" "$docker_version"
if [ $? -eq 11 ]; then if [ $? -eq 11 ]; then
warn "$check_1_6" warn "$check_check_1_6"
warn " * Using $docker_version, when $docker_current_version is current as of $docker_current_date" warn " * Using $docker_version, when $docker_current_version is current as of $docker_current_date"
info " * Your operating system vendor may provide support and security maintenance for docker" info " * Your operating system vendor may provide support and security maintenance for docker"
else else
pass "$check_1_6" pass "$check_check_1_6"
info " * Using $docker_version which is current as of $docker_current_date" info " * Using $docker_version which is current as of $docker_current_date"
info " * Check with your operating system vendor for support and security maintenance for docker" info " * Check with your operating system vendor for support and security maintenance for docker"
fi fi
}
# 1.7 # 1.7
check_1_7="1.7 - Only allow trusted users to control Docker daemon" check_1_7() {
check_check_1_7="1.7 - Only allow trusted users to control Docker daemon"
docker_users=$(getent group docker) docker_users=$(getent group docker)
info "$check_1_7" info "$check_check_1_7"
for u in $docker_users; do for u in $docker_users; do
info " * $u" info " * $u"
done done
}
# 1.8 # 1.8
check_1_8="1.8 - Audit docker daemon" check_1_8() {
check_check_1_8="1.8 - Audit docker daemon"
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep /usr/bin/docker >/dev/null 2>&1 auditctl -l | grep /usr/bin/docker >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_8" pass "$check_check_1_8"
else else
warn "$check_1_8" warn "$check_check_1_8"
fi fi
else else
warn "1.8 - Failed to inspect: auditctl command not found." warn "1.8 - Failed to inspect: auditctl command not found."
fi fi
}
# 1.9 # 1.9
check_1_9="1.9 - Audit Docker files and directories - /var/lib/docker" check_1_9() {
check_check_1_9="1.9 - Audit Docker files and directories - /var/lib/docker"
directory="/var/lib/docker" directory="/var/lib/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $directory >/dev/null 2>&1 auditctl -l | grep $directory >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_9" pass "$check_check_1_9"
else else
warn "$check_1_9" warn "$check_check_1_9"
fi fi
else else
warn "1.9 - Failed to inspect: auditctl command not found." warn "1.9 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_9" info "$check_check_1_9"
info " * Directory not found" info " * Directory not found"
fi fi
}
# 1.10 # 1.10
check_1_10="1.10 - Audit Docker files and directories - /etc/docker" check_1_10() {
check_check_1_10="1.10 - Audit Docker files and directories - /etc/docker"
directory="/etc/docker" directory="/etc/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $directory >/dev/null 2>&1 auditctl -l | grep $directory >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_10" pass "$check_check_1_10"
else else
warn "$check_1_10" warn "$check_check_1_10"
fi fi
else else
warn "1.10 - Failed to inspect: auditctl command not found." warn "1.10 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_10" info "$check_check_1_10"
info " * Directory not found" info " * Directory not found"
fi fi
}
# 1.11 # 1.11
check_1_11="1.11 - Audit Docker files and directories - docker-registry.service" check_1_11() {
check_check_1_11="1.11 - Audit Docker files and directories - docker-registry.service"
file="$(get_systemd_service_file docker-registry.service)" file="$(get_systemd_service_file docker-registry.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_11" pass "$check_check_1_11"
else else
warn "$check_1_11" warn "$check_check_1_11"
fi fi
else else
warn "1.11 - Failed to inspect: auditctl command not found." warn "1.11 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_11" info "$check_check_1_11"
info " * File not found" info " * File not found"
fi fi
}
# 1.12 # 1.12
check_1_12="1.12 - Audit Docker files and directories - docker.service" check_1_12() {
check_check_1_12="1.12 - Audit Docker files and directories - docker.service"
file="$(get_systemd_service_file docker.service)" file="$(get_systemd_service_file docker.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_12" pass "$check_check_1_12"
else else
warn "$check_1_12" warn "$check_check_1_12"
fi fi
else else
warn "1.12 - Failed to inspect: auditctl command not found." warn "1.12 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_12" info "$check_check_1_12"
info " * File not found" info " * File not found"
fi fi
}
# 1.13 # 1.13
check_1_13="1.13 - Audit Docker files and directories - /var/run/docker.sock" check_1_13() {
check_check_1_13="1.13 - Audit Docker files and directories - /var/run/docker.sock"
file="/var/run/docker.sock" file="/var/run/docker.sock"
if [ -e "$file" ]; then if [ -e "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_13" pass "$check_check_1_13"
else else
warn "$check_1_13" warn "$check_check_1_13"
fi fi
else else
warn "1.13 - Failed to inspect: auditctl command not found." warn "1.13 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_13" info "$check_check_1_13"
info " * File not found" info " * File not found"
fi fi
}
# 1.14 # 1.14
check_1_14="1.14 - Audit Docker files and directories - /etc/sysconfig/docker" check_1_14() {
check_check_1_14="1.14 - Audit Docker files and directories - /etc/sysconfig/docker"
file="/etc/sysconfig/docker" file="/etc/sysconfig/docker"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_14" pass "$check_check_1_14"
else else
warn "$check_1_14" warn "$check_check_1_14"
fi fi
else else
warn "1.14 - Failed to inspect: auditctl command not found." warn "1.14 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_14" info "$check_check_1_14"
info " * File not found" info " * File not found"
fi fi
}
# 1.15 # 1.15
check_1_15="1.15 - Audit Docker files and directories - /etc/sysconfig/docker-network" check_1_15() {
check_check_1_15="1.15 - Audit Docker files and directories - /etc/sysconfig/docker-network"
file="/etc/sysconfig/docker-network" file="/etc/sysconfig/docker-network"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_15" pass "$check_check_1_15"
else else
warn "$check_1_15" warn "$check_check_1_15"
fi fi
else else
warn "1.15 - Failed to inspect: auditctl command not found." warn "1.15 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_15" info "$check_check_1_15"
info " * File not found" info " * File not found"
fi fi
}
# 1.16 # 1.16
check_1_16="1.16 - Audit Docker files and directories - /etc/sysconfig/docker-registry" check_1_16() {
check_check_1_16="1.16 - Audit Docker files and directories - /etc/sysconfig/docker-registry"
file="/etc/sysconfig/docker-registry" file="/etc/sysconfig/docker-registry"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_16" pass "$check_check_1_16"
else else
warn "$check_1_16" warn "$check_check_1_16"
fi fi
else else
warn "1.16 - Failed to inspect: auditctl command not found." warn "1.16 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_16" info "$check_check_1_16"
info " * File not found" info " * File not found"
fi fi
}
# 1.17 # 1.17
check_1_17="1.17 - Audit Docker files and directories - /etc/sysconfig/docker-storage" check_1_17() {
check_check_1_17="1.17 - Audit Docker files and directories - /etc/sysconfig/docker-storage"
file="/etc/sysconfig/docker-storage" file="/etc/sysconfig/docker-storage"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_17" pass "$check_check_1_17"
else else
warn "$check_1_17" warn "$check_check_1_17"
fi fi
else else
warn "1.17 - Failed to inspect: auditctl command not found." warn "1.17 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_17" info "$check_check_1_17"
info " * File not found" info " * File not found"
fi fi
}
# 1.18 # 1.18
check_1_18="1.18 - Audit Docker files and directories - /etc/default/docker" check_1_18() {
check_check_1_18="1.18 - Audit Docker files and directories - /etc/default/docker"
file="/etc/default/docker" file="/etc/default/docker"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 command -v auditctl >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
auditctl -l | grep $file >/dev/null 2>&1 auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_1_18" pass "$check_check_1_18"
else else
warn "$check_1_18" warn "$check_check_1_18"
fi fi
else else
warn "1.18 - Failed to inspect: auditctl command not found." warn "1.18 - Failed to inspect: auditctl command not found."
fi fi
else else
info "$check_1_18" info "$check_check_1_18"
info " * File not found" info " * File not found"
fi fi
}

23
tests/2_docker_daemon_configuration.sh
View file

@ -1,9 +1,12 @@
#!/bin/sh #!/bin/sh
check_2() {
logit "\n" logit "\n"
info "2 - Docker Daemon Configuration" info "2 - Docker Daemon Configuration"
}
# 2.1 # 2.1
check_2_1() {
check_2_1="2.1 - Do not use lxc execution driver" check_2_1="2.1 - Do not use lxc execution driver"
get_command_line_args docker | grep lxc >/dev/null 2>&1 get_command_line_args docker | grep lxc >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -11,8 +14,10 @@ if [ $? -eq 0 ]; then
else else
pass "$check_2_1" pass "$check_2_1"
fi fi
}
# 2.2 # 2.2
check_2_2() {
check_2_2="2.2 - Restrict network traffic between containers" check_2_2="2.2 - Restrict network traffic between containers"
get_docker_effective_command_line_args '--icc' | grep "false" >/dev/null 2>&1 get_docker_effective_command_line_args '--icc' | grep "false" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -20,8 +25,10 @@ if [ $? -eq 0 ]; then
else else
warn "$check_2_2" warn "$check_2_2"
fi fi
}
# 2.3 # 2.3
check_2_3() {
check_2_3="2.3 - Set the logging level" check_2_3="2.3 - Set the logging level"
get_docker_effective_command_line_args '-l' | grep "debug" >/dev/null 2>&1 get_docker_effective_command_line_args '-l' | grep "debug" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -29,8 +36,10 @@ if [ $? -eq 0 ]; then
else else
pass "$check_2_3" pass "$check_2_3"
fi fi
}
# 2.4 # 2.4
check_2_4() {
check_2_4="2.4 - Allow Docker to make changes to iptables" check_2_4="2.4 - Allow Docker to make changes to iptables"
get_docker_effective_command_line_args '--iptables' | grep "false" >/dev/null 2>&1 get_docker_effective_command_line_args '--iptables' | grep "false" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -38,8 +47,10 @@ if [ $? -eq 0 ]; then
else else
pass "$check_2_4" pass "$check_2_4"
fi fi
}
# 2.5 # 2.5
check_2_5() {
check_2_5="2.5 - Do not use insecure registries" check_2_5="2.5 - Do not use insecure registries"
get_docker_effective_command_line_args '--insecure-registry' | grep "insecure-registry" >/dev/null 2>&1 get_docker_effective_command_line_args '--insecure-registry' | grep "insecure-registry" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -47,8 +58,10 @@ if [ $? -eq 0 ]; then
else else
pass "$check_2_5" pass "$check_2_5"
fi fi
}
# 2.6 # 2.6
check_2_6() {
check_2_6="2.6 - Setup a local registry mirror" check_2_6="2.6 - Setup a local registry mirror"
get_docker_effective_command_line_args '--registry-mirror' | grep "registry-mirror" >/dev/null 2>&1 get_docker_effective_command_line_args '--registry-mirror' | grep "registry-mirror" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -57,8 +70,10 @@ else
info "$check_2_6" info "$check_2_6"
info " * No local registry currently configured" info " * No local registry currently configured"
fi fi
}
# 2.7 # 2.7
check_2_7() {
check_2_7="2.7 - Do not use the aufs storage driver" check_2_7="2.7 - Do not use the aufs storage driver"
docker info 2>/dev/null | grep -e "^Storage Driver:\s*aufs\s*$" >/dev/null 2>&1 docker info 2>/dev/null | grep -e "^Storage Driver:\s*aufs\s*$" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -66,8 +81,10 @@ if [ $? -eq 0 ]; then
else else
pass "$check_2_7" pass "$check_2_7"
fi fi
}
# 2.8 # 2.8
check_2_8() {
check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket"
get_docker_effective_command_line_args '-H' | grep "\-H" >/dev/null 2>&1 get_docker_effective_command_line_args '-H' | grep "\-H" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -76,8 +93,10 @@ if [ $? -eq 0 ]; then
else else
pass "$check_2_8" pass "$check_2_8"
fi fi
}
# 2.9 # 2.9
check_2_9() {
check_2_9="2.9 - Configure TLS authentication for Docker daemon" check_2_9="2.9 - Configure TLS authentication for Docker daemon"
get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1 get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -93,8 +112,10 @@ else
info "$check_2_9" info "$check_2_9"
info " * Docker daemon not listening on TCP" info " * Docker daemon not listening on TCP"
fi fi
}
# 2.10 # 2.10
check_2_10() {
check_2_10="2.10 - Set default ulimit as appropriate" check_2_10="2.10 - Set default ulimit as appropriate"
get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1 get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
@ -103,4 +124,4 @@ else
info "$check_2_10" info "$check_2_10"
info " * Default ulimit doesn't appear to be set" info " * Default ulimit doesn't appear to be set"
fi fi
}

54
tests/3_docker_daemon_configuration_files.sh
View file

@ -1,9 +1,12 @@
#!/bin/sh #!/bin/sh
check_3() {
logit "\n" logit "\n"
info "3 - Docker Daemon Configuration Files" info "3 - Docker Daemon Configuration Files"
}
# 3.1 # 3.1
check_3_1() {
check_3_1="3.1 - Verify that docker.service file ownership is set to root:root" check_3_1="3.1 - Verify that docker.service file ownership is set to root:root"
file="$(get_systemd_service_file docker.service)" file="$(get_systemd_service_file docker.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -17,8 +20,10 @@ else
info "$check_3_1" info "$check_3_1"
info " * File not found" info " * File not found"
fi fi
}
# 3.2 # 3.2
check_3_2() {
check_3_2="3.2 - Verify that docker.service file permissions are set to 644" check_3_2="3.2 - Verify that docker.service file permissions are set to 644"
file="$(get_systemd_service_file docker.service)" file="$(get_systemd_service_file docker.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -32,8 +37,10 @@ else
info "$check_3_2" info "$check_3_2"
info " * File not found" info " * File not found"
fi fi
}
# 3.3 # 3.3
check_3_3() {
check_3_3="3.3 - Verify that docker-registry.service file ownership is set to root:root" check_3_3="3.3 - Verify that docker-registry.service file ownership is set to root:root"
file="$(get_systemd_service_file docker-registry.service)" file="$(get_systemd_service_file docker-registry.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -47,8 +54,10 @@ else
info "$check_3_3" info "$check_3_3"
info " * File not found" info " * File not found"
fi fi
}
# 3.4 # 3.4
check_3_4() {
check_3_4="3.4 - Verify that docker-registry.service file permissions are set to 644" check_3_4="3.4 - Verify that docker-registry.service file permissions are set to 644"
file="$(get_systemd_service_file docker-registry.service)" file="$(get_systemd_service_file docker-registry.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -62,8 +71,10 @@ else
info "$check_3_4" info "$check_3_4"
info " * File not found" info " * File not found"
fi fi
}
# 3.5 # 3.5
check_3_5() {
check_3_5="3.5 - Verify that docker.socket file ownership is set to root:root" check_3_5="3.5 - Verify that docker.socket file ownership is set to root:root"
file="$(get_systemd_service_file docker.socket)" file="$(get_systemd_service_file docker.socket)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -77,8 +88,10 @@ else
info "$check_3_5" info "$check_3_5"
info " * File not found" info " * File not found"
fi fi
}
# 3.6 # 3.6
check_3_6() {
check_3_6="3.6 - Verify that docker.socket file permissions are set to 644" check_3_6="3.6 - Verify that docker.socket file permissions are set to 644"
file="$(get_systemd_service_file docker.socket)" file="$(get_systemd_service_file docker.socket)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -92,8 +105,10 @@ else
info "$check_3_6" info "$check_3_6"
info " * File not found" info " * File not found"
fi fi
}
# 3.7 # 3.7
check_3_7() {
check_3_7="3.7 - Verify that Docker environment file ownership is set to root:root " check_3_7="3.7 - Verify that Docker environment file ownership is set to root:root "
file="/etc/sysconfig/docker" file="/etc/sysconfig/docker"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -107,8 +122,10 @@ else
info "$check_3_7" info "$check_3_7"
info " * File not found" info " * File not found"
fi fi
}
# 3.8 # 3.8
check_3_8() {
check_3_8="3.8 - Verify that Docker environment file permissions are set to 644" check_3_8="3.8 - Verify that Docker environment file permissions are set to 644"
file="/etc/sysconfig/docker" file="/etc/sysconfig/docker"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -122,8 +139,10 @@ else
info "$check_3_8" info "$check_3_8"
info " * File not found" info " * File not found"
fi fi
}
# 3.9 # 3.9
check_3_9() {
check_3_9="3.9 - Verify that docker-network environment file ownership is set to root:root" check_3_9="3.9 - Verify that docker-network environment file ownership is set to root:root"
file="/etc/sysconfig/docker-network" file="/etc/sysconfig/docker-network"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -137,8 +156,10 @@ else
info "$check_3_9" info "$check_3_9"
info " * File not found" info " * File not found"
fi fi
}
# 3.10 # 3.10
check_3_10() {
check_3_10="3.10 - Verify that docker-network environment file permissions are set to 644" check_3_10="3.10 - Verify that docker-network environment file permissions are set to 644"
file="/etc/sysconfig/docker-network" file="/etc/sysconfig/docker-network"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -152,8 +173,10 @@ else
info "$check_3_10" info "$check_3_10"
info " * File not found" info " * File not found"
fi fi
}
# 3.11 # 3.11
check_3_11() {
check_3_11="3.11 - Verify that docker-registry environment file ownership is set to root:root" check_3_11="3.11 - Verify that docker-registry environment file ownership is set to root:root"
file="/etc/sysconfig/docker-registry" file="/etc/sysconfig/docker-registry"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -167,8 +190,10 @@ else
info "$check_3_11" info "$check_3_11"
info " * File not found" info " * File not found"
fi fi
}
# 3.12 # 3.12
check_3_12() {
check_3_12="3.12 - Verify that docker-registry environment file permissions are set to 644" check_3_12="3.12 - Verify that docker-registry environment file permissions are set to 644"
file="/etc/sysconfig/docker-registry" file="/etc/sysconfig/docker-registry"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -182,8 +207,10 @@ else
info "$check_3_12" info "$check_3_12"
info " * File not found" info " * File not found"
fi fi
}
# 3.13 # 3.13
check_3_13() {
check_3_13="3.13 - Verify that docker-storage environment file ownership is set to root:root" check_3_13="3.13 - Verify that docker-storage environment file ownership is set to root:root"
file="/etc/sysconfig/docker-storage" file="/etc/sysconfig/docker-storage"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -197,8 +224,10 @@ else
info "$check_3_13" info "$check_3_13"
info " * File not found" info " * File not found"
fi fi
}
# 3.14 # 3.14
check_3_14() {
check_3_14="3.14 - Verify that docker-storage environment file permissions are set to 644" check_3_14="3.14 - Verify that docker-storage environment file permissions are set to 644"
file="/etc/sysconfig/docker-storage" file="/etc/sysconfig/docker-storage"
if [ -f "$file" ]; then if [ -f "$file" ]; then
@ -212,8 +241,10 @@ else
info "$check_3_14" info "$check_3_14"
info " * File not found" info " * File not found"
fi fi
}
# 3.15 # 3.15
check_3_15() {
check_3_15="3.15 - Verify that /etc/docker directory ownership is set to root:root" check_3_15="3.15 - Verify that /etc/docker directory ownership is set to root:root"
directory="/etc/docker" directory="/etc/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
@ -227,8 +258,10 @@ else
info "$check_3_15" info "$check_3_15"
info " * Directory not found" info " * Directory not found"
fi fi
}
# 3.16 # 3.16
check_3_16() {
check_3_16="3.16 - Verify that /etc/docker directory permissions are set to 755" check_3_16="3.16 - Verify that /etc/docker directory permissions are set to 755"
directory="/etc/docker" directory="/etc/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
@ -244,8 +277,10 @@ else
info "$check_3_16" info "$check_3_16"
info " * Directory not found" info " * Directory not found"
fi fi
}
# 3.17 # 3.17
check_3_17() {
check_3_17="3.17 - Verify that registry certificate file ownership is set to root:root" check_3_17="3.17 - Verify that registry certificate file ownership is set to root:root"
directory="/etc/docker/certs.d/" directory="/etc/docker/certs.d/"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
@ -267,8 +302,10 @@ else
info "$check_3_17" info "$check_3_17"
info " * Directory not found" info " * Directory not found"
fi fi
}
# 3.18 # 3.18
check_3_18() {
check_3_18="3.18 - Verify that registry certificate file permissions are set to 444" check_3_18="3.18 - Verify that registry certificate file permissions are set to 444"
directory="/etc/docker/certs.d/" directory="/etc/docker/certs.d/"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
@ -289,8 +326,10 @@ else
info "$check_3_18" info "$check_3_18"
info " * Directory not found" info " * Directory not found"
fi fi
}
# 3.19 # 3.19
check_3_19() {
check_3_19="3.19 - Verify that TLS CA certificate file ownership is set to root:root" check_3_19="3.19 - Verify that TLS CA certificate file ownership is set to root:root"
tlscacert=$(get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) tlscacert=$(get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
if [ -f "$tlscacert" ]; then if [ -f "$tlscacert" ]; then
@ -304,8 +343,10 @@ else
info "$check_3_19" info "$check_3_19"
info " * No TLS CA certificate found" info " * No TLS CA certificate found"
fi fi
}
# 3.20 # 3.20
check_3_20() {
check_3_20="3.20 - Verify that TLS CA certificate file permissions are set to 444" check_3_20="3.20 - Verify that TLS CA certificate file permissions are set to 444"
tlscacert=$(get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) tlscacert=$(get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
if [ -f "$tlscacert" ]; then if [ -f "$tlscacert" ]; then
@ -320,8 +361,10 @@ else
info "$check_3_20" info "$check_3_20"
info " * No TLS CA certificate found" info " * No TLS CA certificate found"
fi fi
}
# 3.21 # 3.21
check_3_21() {
check_3_21="3.21 - Verify that Docker server certificate file ownership is set to root:root" check_3_21="3.21 - Verify that Docker server certificate file ownership is set to root:root"
tlscert=$(get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) tlscert=$(get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
if [ -f "$tlscert" ]; then if [ -f "$tlscert" ]; then
@ -335,8 +378,10 @@ else
info "$check_3_21" info "$check_3_21"
info " * No TLS Server certificate found" info " * No TLS Server certificate found"
fi fi
}
# 3.22 # 3.22
check_3_22() {
check_3_22="3.22 - Verify that Docker server certificate file permissions are set to 444" check_3_22="3.22 - Verify that Docker server certificate file permissions are set to 444"
tlscert=$(get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) tlscert=$(get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
if [ -f "$tlscert" ]; then if [ -f "$tlscert" ]; then
@ -351,8 +396,10 @@ else
info "$check_3_22" info "$check_3_22"
info " * No TLS Server certificate found" info " * No TLS Server certificate found"
fi fi
}
# 3.23 # 3.23
check_3_23() {
check_3_23="3.23 - Verify that Docker server key file ownership is set to root:root" check_3_23="3.23 - Verify that Docker server key file ownership is set to root:root"
tlskey=$(get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) tlskey=$(get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
if [ -f "$tlskey" ]; then if [ -f "$tlskey" ]; then
@ -366,8 +413,10 @@ else
info "$check_3_23" info "$check_3_23"
info " * No TLS Key found" info " * No TLS Key found"
fi fi
}
# 3.24 # 3.24
check_3_24() {
check_3_24="3.24 - Verify that Docker server key file permissions are set to 400" check_3_24="3.24 - Verify that Docker server key file permissions are set to 400"
tlskey=$(get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) tlskey=$(get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1)
if [ -f "$tlskey" ]; then if [ -f "$tlskey" ]; then
@ -382,8 +431,10 @@ else
info "$check_3_24" info "$check_3_24"
info " * No TLS Key found" info " * No TLS Key found"
fi fi
}
# 3.25 # 3.25
check_3_25(){
check_3_25="3.25 - Verify that Docker socket file ownership is set to root:docker" check_3_25="3.25 - Verify that Docker socket file ownership is set to root:docker"
file="/var/run/docker.sock" file="/var/run/docker.sock"
if [ -S "$file" ]; then if [ -S "$file" ]; then
@ -397,8 +448,10 @@ else
info "$check_3_25" info "$check_3_25"
info " * File not found" info " * File not found"
fi fi
}
# 3.26 # 3.26
check_3_26() {
check_3_26="3.26 - Verify that Docker socket file permissions are set to 660" check_3_26="3.26 - Verify that Docker socket file permissions are set to 660"
file="/var/run/docker.sock" file="/var/run/docker.sock"
if [ -S "$file" ]; then if [ -S "$file" ]; then
@ -413,3 +466,4 @@ else
info "$check_3_26" info "$check_3_26"
info " * File not found" info " * File not found"
fi fi
}

4
tests/4_container_images.sh
View file

@ -1,9 +1,12 @@
#!/bin/sh #!/bin/sh
check_4() {
logit "\n" logit "\n"
info "4 - Container Images and Build Files" info "4 - Container Images and Build Files"
}
# 4.1 # 4.1
check_4_1() {
check_4_1="4.1 - Create a user for the container" check_4_1="4.1 - Create a user for the container"
# If container_users is empty, there are no running containers # If container_users is empty, there are no running containers
@ -37,3 +40,4 @@ else
fi fi
# Make the loop separator go back to space # Make the loop separator go back to space
set +f; unset IFS set +f; unset IFS
}

117
tests/5_container_runtime.sh
View file

@ -1,16 +1,29 @@
#!/bin/sh #!/bin/sh
check_5() {
logit "\n" logit "\n"
info "5 - Container Runtime" info "5 - Container Runtime"
}
check_running_containers() {
# If containers is empty, there are no running containers # If containers is empty, there are no running containers
if [ -z "$containers" ]; then if [ -z "$containers" ]; then
info " * No containers running, skipping Section 5" info " * No containers running, skipping Section 5"
running_containers=0
else else
running_containers=1
# Make the loop separator be a new-line in POSIX compliant fashion # Make the loop separator be a new-line in POSIX compliant fashion
set -f; IFS=$' set -f; IFS=$'
' '
fi
}
# 5.1 # 5.1
check_5_1() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_1="5.1 - Verify AppArmor Profile, if applicable" check_5_1="5.1 - Verify AppArmor Profile, if applicable"
fail=0 fail=0
@ -32,8 +45,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_1" pass "$check_5_1"
fi fi
}
# 5.2 # 5.2
check_5_2() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_2="5.2 - Verify SELinux security options, if applicable" check_5_2="5.2 - Verify SELinux security options, if applicable"
fail=0 fail=0
@ -55,8 +74,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_2" pass "$check_5_2"
fi fi
}
# 5.3 # 5.3
check_5_3() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_3="5.3 - Verify that containers are running only a single main process" check_5_3="5.3 - Verify that containers are running only a single main process"
fail=0 fail=0
@ -90,8 +115,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_3" pass "$check_5_3"
fi fi
}
# 5.4 # 5.4
check_5_4() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_4="5.4 - Restrict Linux Kernel Capabilities within containers" check_5_4="5.4 - Restrict Linux Kernel Capabilities within containers"
fail=0 fail=0
@ -113,8 +144,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_4" pass "$check_5_4"
fi fi
}
# 5.5 # 5.5
check_5_5() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_5="5.5 - Do not use privileged containers" check_5_5="5.5 - Do not use privileged containers"
fail=0 fail=0
@ -136,8 +173,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_5" pass "$check_5_5"
fi fi
}
# 5.6 # 5.6
check_5_6() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_6="5.6 - Do not mount sensitive host system directories on containers" check_5_6="5.6 - Do not mount sensitive host system directories on containers"
# List of sensitive directories to test for. Script uses new-lines as a separator. # List of sensitive directories to test for. Script uses new-lines as a separator.
@ -178,8 +221,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_6" pass "$check_5_6"
fi fi
}
# 5.7 # 5.7
check_5_8() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_7="5.7 - Do not run ssh within containers" check_5_7="5.7 - Do not run ssh within containers"
fail=0 fail=0
@ -214,8 +263,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_7" pass "$check_5_7"
fi fi
}
# 5.8 # 5.8
check_5_8() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_8="5.8 - Do not map privileged ports within containers" check_5_8="5.8 - Do not map privileged ports within containers"
fail=0 fail=0
@ -241,8 +296,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_8" pass "$check_5_8"
fi fi
}
# 5.10 # 5.10
check_5_10() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_10="5.10 - Do not use host network mode on container" check_5_10="5.10 - Do not use host network mode on container"
fail=0 fail=0
@ -264,8 +325,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_10" pass "$check_5_10"
fi fi
}
# 5.11 # 5.11
check_5_11() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_11="5.11 - Limit memory usage for container" check_5_11="5.11 - Limit memory usage for container"
fail=0 fail=0
@ -293,8 +360,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_11" pass "$check_5_11"
fi fi
}
# 5.12 # 5.12
check_5_12() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_12="5.12 - Set container CPU priority appropriately" check_5_12="5.12 - Set container CPU priority appropriately"
fail=0 fail=0
@ -322,8 +395,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_12" pass "$check_5_12"
fi fi
}
# 5.13 # 5.13
check_5_12(){
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_13="5.13 - Mount container's root filesystem as read only" check_5_13="5.13 - Mount container's root filesystem as read only"
fail=0 fail=0
@ -345,8 +424,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_13" pass "$check_5_13"
fi fi
}
# 5.14 # 5.14
check_5_14() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_14="5.14 - Bind incoming container traffic to a specific host interface" check_5_14="5.14 - Bind incoming container traffic to a specific host interface"
fail=0 fail=0
@ -368,8 +453,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_14" pass "$check_5_14"
fi fi
}
# 5.15 # 5.15
check_5_15() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_15="5.15 - Do not set the 'on-failure' container restart policy to always" check_5_15="5.15 - Do not set the 'on-failure' container restart policy to always"
fail=0 fail=0
@ -391,8 +482,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_15" pass "$check_5_15"
fi fi
}
# 5.16 # 5.16
check_5_16() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_16="5.16 - Do not share the host's process namespace" check_5_16="5.16 - Do not share the host's process namespace"
fail=0 fail=0
@ -414,8 +511,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_16" pass "$check_5_16"
fi fi
}
# 5.17 # 5.17
check_5_17() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_17="5.17 - Do not share the host's IPC namespace" check_5_17="5.17 - Do not share the host's IPC namespace"
fail=0 fail=0
@ -437,8 +540,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_17" pass "$check_5_17"
fi fi
}
# 5.18 # 5.18
check_5_18() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_18="5.18 - Do not directly expose host devices to containers" check_5_18="5.18 - Do not directly expose host devices to containers"
fail=0 fail=0
@ -460,8 +569,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_18" pass "$check_5_18"
fi fi
}
# 5.19 # 5.19
check_5_19() {
if [ "$running_containers" -ne 1 ]; then
return
fi
check_5_19="5.19 - Override default ulimit at runtime only if needed" check_5_19="5.19 - Override default ulimit at runtime only if needed"
# List all the running containers, ouput their ID and host devices # List all the running containers, ouput their ID and host devices
@ -484,4 +599,4 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_19" pass "$check_5_19"
fi fi
fi }

8
tests/6_docker_security_operations.sh
View file

@ -1,9 +1,12 @@
#!/bin/sh #!/bin/sh
check_6() {
logit "\n" logit "\n"
info "6 - Docker Security Operations" info "6 - Docker Security Operations"
}
# 6.5 # 6.5
check_6_5() {
check_6_5="6.5 - Use a centralized and remote log collection service" check_6_5="6.5 - Use a centralized and remote log collection service"
# If containers is empty, there are no running containers # If containers is empty, there are no running containers
@ -39,8 +42,10 @@ else
fi fi
# Make the loop separator go back to space # Make the loop separator go back to space
set +f; unset IFS set +f; unset IFS
}
# 6.6 # 6.6
check_6_6() {
check_6_6="6.6 - Avoid image sprawl" check_6_6="6.6 - Avoid image sprawl"
images=$(docker images -q | sort -u | wc -l | awk '{print $1}') images=$(docker images -q | sort -u | wc -l | awk '{print $1}')
active_images=0 active_images=0
@ -62,8 +67,10 @@ fi
if [ "$active_images" -lt "$((images / 2))" ]; then if [ "$active_images" -lt "$((images / 2))" ]; then
warn " * Only $active_images out of $images are in use" warn " * Only $active_images out of $images are in use"
fi fi
}
# 6.7 # 6.7
check_6_7() {
check_6_7="6.7 - Avoid container sprawl" check_6_7="6.7 - Avoid container sprawl"
total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}') total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}')
running_containers=$(docker ps -q | wc -l | awk '{print $1}') running_containers=$(docker ps -q | wc -l | awk '{print $1}')
@ -75,3 +82,4 @@ else
info "$check_6_7" info "$check_6_7"
info " * There are currently a total of $total_containers containers, with $running_containers of them currently running" info " * There are currently a total of $total_containers containers, with $running_containers of them currently running"
fi fi
}

12
tests/X_community_tests.sh Normal file
View file

@ -0,0 +1,12 @@
#!/bin/sh
check_community() {
logit "\n"
info "X - Community contributed tests"
}
check_community_1() {
check_community_1="X.1 - Placeholder"
echo "This is just a placeholder."
}