GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-18 16:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #493 from konstruktoid/ISSUE492

Browse source 
if configured with no-new-privileges, pass check 5.25
This commit is contained in:
Thomas Sjögren 2021-12-16 10:36:23 +01:00 committed by GitHub
commit 1ff4a62836
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
tests/5_container_runtime.sh
View file

@ -970,7 +970,14 @@ check_5_25() {
starttestjson "$id" "$desc"
fail=0
no_priv_config=0
addprivs_containers=""
if get_docker_effective_command_line_args '--no-new-privileges' | grep "no-new-privileges" >/dev/null 2>&1; then
no_priv_config=1
elif get_docker_configuration_file_args 'no-new-privileges' | grep true >/dev/null 2>&1; then
no_priv_config=1
else
for c in $containers; do
if ! docker inspect --format 'SecurityOpt={{.HostConfig.SecurityOpt }}' "$c" | grep 'no-new-privileges' 2>/dev/null 1>&2; then
# If it's the first container, fail the test
@ -985,8 +992,10 @@ check_5_25() {
addprivs_containers="$addprivs_containers $c"
fi
done
fi
# We went through all the containers and found none with capability to acquire additional privileges
if [ $fail -eq 0 ]; then
if [ $fail -eq 0 ] || [ $no_priv_config -eq 1 ]; then
pass -s "$check"
logcheckresult "PASS"
return