Squash into one PR

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

.dockerignore

@@ -0,0 +1 @@
+.git

helper_lib.sh

@@ -1,5 +1,8 @@
 #!/bin/sh
 
+ps_command=$(command -v ps)
+ps_args='-U root -u root -f'
+
 # Returns the absolute path of a given string
 abspath () { case "$1" in /*)printf "%s\n" "$1";; *)printf "%s\n" "$PWD/$1";; esac; }
 

tests/1_host_configuration.sh

@@ -40,6 +40,7 @@ fi
 # 1.6
 check_1_6="1.6  - Keep Docker up to date"
 docker_version=`docker version | grep 'Server version' | awk '{print $3}'`
+do_version_check 1.6.2 $docker_version
 if [ $? -eq 11 ]; then
   warn "$check_1_6"
 else
@@ -48,7 +49,7 @@ fi
 
 # 1.7
 check_1_7="1.7  - Only allow trusted users to control Docker daemon"
-docker_users=`cat /etc/group | grep docker`
+docker_users=`grep docker /etc/group`
 info "$check_1_7"
 for u in $docker_users; do
   info "     * $u"

tests/2_docker_daemon_configuration.sh

@@ -5,7 +5,7 @@ info "2 - Docker Daemon Configuration"
 
 # 2.1
 check_2_1="2.1  - Do not use lxc execution driver"
-ps -ef | grep docker | grep lxc >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep lxc >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   warn "$check_2_1"
 else
@@ -14,7 +14,7 @@ fi
 
 # 2.2
 check_2_2="2.2  - Restrict network traffic between containers"
-ps -ef | grep docker | grep "icc=false" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "icc=false" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   pass "$check_2_2"
 else
@@ -23,7 +23,7 @@ fi
 
 # 2.3
 check_2_3="2.3  - Set the logging level"
-ps -ef | grep docker | grep "log-level=\"debug\"" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "log-level=\"debug\"" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   warn "$check_2_3"
 else
@@ -32,7 +32,7 @@ fi
 
 # 2.4
 check_2_4="2.4  - Allow Docker to make changes to iptables"
-ps -ef | grep docker | grep "iptables=false" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "iptables=false" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   warn "$check_2_4"
 else
@@ -41,7 +41,7 @@ fi
 
 # 2.5
 check_2_5="2.5  - Do not use insecure registries"
-ps -ef | grep docker | grep "insecure-registry" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "insecure-registry" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   warn "$check_2_5"
 else
@@ -50,7 +50,7 @@ fi
 
 # 2.6
 check_2_6="2.6  - Setup a local registry mirror"
-ps -ef | grep docker | grep "registry-mirror" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "registry-mirror" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   pass "$check_2_6"
 else
@@ -69,7 +69,7 @@ fi
 
 # 2.8
 check_2_8="2.8  - Do not bind Docker to another IP/Port or a Unix socket"
-ps -ef | grep docker | grep "\-H" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "\-H" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   info "$check_2_8"
   info "     * Docker daemon running with -H"
@@ -79,9 +79,9 @@ fi
 
 # 2.9
 check_2_9="2.9  - Configure TLS authentication for Docker daemon"
-ps -ef | grep docker | grep "tcp://" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "tcp://" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
-  ps -ef | grep docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
+  $ps_command $ps_args | grep docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
   if [ $? -eq 0 ]; then
     pass "$check_2_9"
     info "     * Docker daemon currently listening on TCP"
@@ -96,7 +96,7 @@ fi
 
 # 2.10
 check_2_10="2.10 - Set default ulimit as appropriate"
-ps -ef | grep docker | grep "default-ulimit" >/dev/null 2>&1
+$ps_command $ps_args | grep docker | grep "default-ulimit" >/dev/null 2>&1
 if [ $? -eq 0 ]; then
   pass "$check_2_10"
 else

tests/5_container_runtime.sh

@@ -61,6 +61,13 @@ else
 
   fail=0
   for c in $containers; do
+    exec_check=`docker exec $c ps -el 2>/dev/null`
+    if [ $? -eq 255 ]; then
+      warn "$check_5_3"
+      warn "      * Docker exec fails: $c"
+      fail=1
+    fi
+
     processes=`docker exec $c ps -el 2>/dev/null | wc -l | awk '{print $1}'`
     if [ $processes -gt 5 ]; then
       # If it's the first container, fail the test
@@ -165,8 +172,14 @@ else
 
   fail=0
   for c in $containers; do
-    processes=`docker exec $c ps -el 2>/dev/null | grep sshd | wc -l | awk '{print $1}'`
+    exec_check=`docker exec $c ps -el 2>/dev/null`
+    if [ $? -eq 255 ]; then
+      warn "$check_5_7"
+      warn "     * Docker exec failed: $c"
+      fail=1
+    fi
 
+    processes=`docker exec $c ps -el 2>/dev/null | grep sshd | wc -l | awk '{print $1}'`
     if [ $processes -gt 1 ]; then
       # If it's the first container, fail the test
       if [ $fail -eq 0 ]; then