From fc8eefb8a6df4f0f46adf57c64fcf71dcadcee70 Mon Sep 17 00:00:00 2001 From: Joachim Lusiardi Date: Mon, 22 Jun 2015 21:36:56 +0200 Subject: [PATCH 1/3] Fix for issue #47. Introduces a new function in helper_lib.sh to query the command line arguments of the running instances of a binary. This is done to get rid of the problem of "-lf" versus "-alf" for pgrep. Signed-off-by: Joachim Lusiardi --- helper_lib.sh | 10 ++++++++++ tests/2_docker_daemon_configuration.sh | 21 +++++++++++---------- 2 files changed, 21 insertions(+), 10 deletions(-) diff --git a/helper_lib.sh b/helper_lib.sh index ece69c8..bba1a9c 100644 --- a/helper_lib.sh +++ b/helper_lib.sh @@ -36,3 +36,13 @@ contains() { return 1 # $substring is not in $string fi } + +# Extracts all commandline args from all running processes named like the first parameter +get_command_line_args() { + PROC="$1" + + for PID in `pgrep $PROC` + do + cat /proc/$PID/cmdline | tr "\0" " " + done +} diff --git a/tests/2_docker_daemon_configuration.sh b/tests/2_docker_daemon_configuration.sh index af443ca..ab51b4e 100644 --- a/tests/2_docker_daemon_configuration.sh +++ b/tests/2_docker_daemon_configuration.sh @@ -5,7 +5,7 @@ info "2 - Docker Daemon Configuration" # 2.1 check_2_1="2.1 - Do not use lxc execution driver" -pgrep -lf docker | grep lxc >/dev/null 2>&1 +get_command_line_args docker | grep lxc >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_1" else @@ -14,7 +14,7 @@ fi # 2.2 check_2_2="2.2 - Restrict network traffic between containers" -pgrep -lf docker | grep "icc=false" >/dev/null 2>&1 +get_command_line_args docker | grep "icc=false" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_2" else @@ -23,7 +23,7 @@ fi # 2.3 check_2_3="2.3 - Set the logging level" -pgrep -lf docker | grep "log-level=\"debug\"" >/dev/null 2>&1 +get_command_line_args docker | grep "log-level=\"debug\"" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_3" else @@ -32,7 +32,7 @@ fi # 2.4 check_2_4="2.4 - Allow Docker to make changes to iptables" -pgrep -lf docker | grep "iptables=false" >/dev/null 2>&1 +get_command_line_args docker | grep "iptables=false" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_4" else @@ -41,7 +41,7 @@ fi # 2.5 check_2_5="2.5 - Do not use insecure registries" -pgrep -lf docker | grep "insecure-registry" >/dev/null 2>&1 +get_command_line_args docker | grep "insecure-registry" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_5" else @@ -50,7 +50,7 @@ fi # 2.6 check_2_6="2.6 - Setup a local registry mirror" -pgrep -lf docker | grep "registry-mirror" >/dev/null 2>&1 +get_command_line_args docker | grep "registry-mirror" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_6" else @@ -69,7 +69,7 @@ fi # 2.8 check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" -pgrep -lf docker | grep "\-H" >/dev/null 2>&1 +get_command_line_args docker | grep "\-H" >/dev/null 2>&1 if [ $? -eq 0 ]; then info "$check_2_8" info " * Docker daemon running with -H" @@ -79,9 +79,9 @@ fi # 2.9 check_2_9="2.9 - Configure TLS authentication for Docker daemon" -pgrep -lf docker | grep "\-H" >/dev/null 2>&1 +get_command_line_args docker | grep "\-H" >/dev/null 2>&1 if [ $? -eq 0 ]; then - pgrep -lf docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 + get_command_line_args docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_9" info " * Docker daemon currently listening on TCP" @@ -96,10 +96,11 @@ fi # 2.10 check_2_10="2.10 - Set default ulimit as appropriate" -pgrep -lf docker | grep "default-ulimit" >/dev/null 2>&1 +get_command_line_args docker | grep "default-ulimit" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_10" else info "$check_2_10" info " * Default ulimit doesn't appear to be set" fi + From fae2639313196d2aefb22ca955f3fd9b9fd7a38a Mon Sep 17 00:00:00 2001 From: Joachim Lusiardi Date: Fri, 26 Jun 2015 07:18:18 +0200 Subject: [PATCH 2/3] Addition to fix for issue #47. Missed the potentially wrong invocations of pgrep also in section 3 of the tests. Replace "pgrep -lf" there as well. Signed-off-by: Joachim Lusiardi --- tests/3_docker_daemon_configuration_files.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/3_docker_daemon_configuration_files.sh b/tests/3_docker_daemon_configuration_files.sh index 1f9cfe9..491f538 100644 --- a/tests/3_docker_daemon_configuration_files.sh +++ b/tests/3_docker_daemon_configuration_files.sh @@ -292,7 +292,7 @@ fi # 3.19 check_3_19="3.19 - Verify that TLS CA certificate file ownership is set to root:root" -tlscacert=$(pgrep -lf docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1) +tlscacert=$(get_command_line_args docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1) if [ -f "$tlscacert" ]; then if [ "$(stat -c %u%g $file)" -eq 00 ]; then pass "$check_3_19" @@ -307,7 +307,7 @@ fi # 3.20 check_3_20="3.20 - Verify that TLS CA certificate file permissions are set to 444" -tlscacert=$(pgrep -lf docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1) +tlscacert=$(get_command_line_args docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1) if [ -f "$tlscacert" ]; then perms=$(ls -ld "$tlscacert" | awk '{print $1}') if [ "$perms" = "-r--r--r--" ]; then @@ -323,7 +323,7 @@ fi # 3.21 check_3_21="3.21 - Verify that Docker server certificate file ownership is set to root:root" -tlscert=$(pgrep -lf docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1) +tlscert=$(get_command_line_args docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1) if [ -f "$tlscert" ]; then if [ "$(stat -c %u%g $file)" -eq 00 ]; then pass "$check_3_21" @@ -338,7 +338,7 @@ fi # 3.22 check_3_22="3.22 - Verify that Docker server certificate file permissions are set to 444" -tlscacert=$(pgrep -lf docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1) +tlscacert=$(get_command_line_args docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1) if [ -f "$tlscert" ]; then perms=$(ls -ld "$tlscert" | awk '{print $1}') if [ "$perms" = "-r--r--r--" ]; then @@ -354,7 +354,7 @@ fi # 3.23 check_3_23="3.23 - Verify that Docker server key file ownership is set to root:root" -tlskey=$(pgrep -lf docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1) +tlskey=$(get_command_line_args docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1) if [ -f "$tlskey" ]; then if [ "$(stat -c %u%g $file)" -eq 00 ]; then pass "$check_3_23" @@ -369,7 +369,7 @@ fi # 3.24 check_3_24="3.24 - Verify that Docker server key file permissions are set to 400" -tlskey=$(pgrep -lf docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1) +tlskey=$(get_command_line_args docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1) if [ -f "$tlskey" ]; then perms=$(ls -ld "$tlskey" | awk '{print $1}') if [ "$perms" = "-r--------" ]; then From 2d29af704e9f26a1ae4972825da34ad5a8d2899e Mon Sep 17 00:00:00 2001 From: Joachim Lusiardi Date: Mon, 29 Jun 2015 22:22:12 +0200 Subject: [PATCH 3/3] Improve fix for issue 47 using prep -x -o The use of `pgrep -x`was proposed by @rnelson0. `pgrep -x -o` should limit the result to the oldest exactly matching execution of a binary called `docker`. Signed-off-by: Joachim Lusiardi --- helper_lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helper_lib.sh b/helper_lib.sh index bba1a9c..12276e2 100644 --- a/helper_lib.sh +++ b/helper_lib.sh @@ -41,7 +41,7 @@ contains() { get_command_line_args() { PROC="$1" - for PID in `pgrep $PROC` + for PID in `pgrep -x -o $PROC` do cat /proc/$PID/cmdline | tr "\0" " " done