From 01c915485ecaa773e4f87f9c6c063d5c34856259 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 30 May 2015 12:59:22 +0200 Subject: [PATCH 1/8] add .dockerignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- .dockerignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..6b8710a --- /dev/null +++ b/.dockerignore @@ -0,0 +1 @@ +.git From 32bdece6acaf8ab59abc6e57e53c5b7005bf2648 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 30 May 2015 13:00:29 +0200 Subject: [PATCH 2/8] restrictive PATH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- docker-bench-security.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-bench-security.sh b/docker-bench-security.sh index 6ebe45b..7b0c98f 100644 --- a/docker-bench-security.sh +++ b/docker-bench-security.sh @@ -19,6 +19,7 @@ dir_name=`dirname ${this_path}` ## Dir where this file is myname=`basename ${this_path}` ## file name of this script. logger="${myname}.log" +export PATH=/bin:/sbin:/usr/bin # Check for required program(s) req_progs='docker netstat grep awk' From 7082102612abc2745761ab05502efc674b632b68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 30 May 2015 13:01:19 +0200 Subject: [PATCH 3/8] add ps variable and limit output to root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- helper_lib.sh | 3 +++ tests/2_docker_daemon_configuration.sh | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/helper_lib.sh b/helper_lib.sh index e692deb..8c6cfbb 100644 --- a/helper_lib.sh +++ b/helper_lib.sh @@ -1,5 +1,8 @@ #!/bin/sh +ps_command=$(command -v ps) +ps_args='-U root -u root -f' + # Returns the absolute path of a given string abspath () { case "$1" in /*)printf "%s\n" "$1";; *)printf "%s\n" "$PWD/$1";; esac; } diff --git a/tests/2_docker_daemon_configuration.sh b/tests/2_docker_daemon_configuration.sh index 11a0ea9..46d8307 100644 --- a/tests/2_docker_daemon_configuration.sh +++ b/tests/2_docker_daemon_configuration.sh @@ -5,7 +5,7 @@ info "2 - Docker Daemon Configuration" # 2.1 check_2_1="2.1 - Do not use lxc execution driver" -ps -ef | grep docker | grep lxc >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep lxc >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_1" else @@ -14,7 +14,7 @@ fi # 2.2 check_2_2="2.2 - Restrict network traffic between containers" -ps -ef | grep docker | grep "icc=false" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "icc=false" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_2" else @@ -23,7 +23,7 @@ fi # 2.3 check_2_3="2.3 - Set the logging level" -ps -ef | grep docker | grep "log-level=\"debug\"" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "log-level=\"debug\"" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_3" else @@ -32,7 +32,7 @@ fi # 2.4 check_2_4="2.4 - Allow Docker to make changes to iptables" -ps -ef | grep docker | grep "iptables=false" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "iptables=false" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_4" else @@ -41,7 +41,7 @@ fi # 2.5 check_2_5="2.5 - Do not use insecure registries" -ps -ef | grep docker | grep "insecure-registry" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "insecure-registry" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_5" else @@ -50,7 +50,7 @@ fi # 2.6 check_2_6="2.6 - Setup a local registry mirror" -ps -ef | grep docker | grep "registry-mirror" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "registry-mirror" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_6" else @@ -69,7 +69,7 @@ fi # 2.8 check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" -ps -ef | grep docker | grep "\-H" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "\-H" >/dev/null 2>&1 if [ $? -eq 0 ]; then info "$check_2_8" info " * Docker daemon running with -H" @@ -79,9 +79,9 @@ fi # 2.9 check_2_9="2.9 - Configure TLS authentication for Docker daemon" -ps -ef | grep docker | grep "tcp://" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "tcp://" >/dev/null 2>&1 if [ $? -eq 0 ]; then - ps -ef | grep docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 + $ps_command $ps_args | grep docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_9" info " * Docker daemon currently listening on TCP" @@ -96,7 +96,7 @@ fi # 2.10 check_2_10="2.10 - Set default ulimit as appropriate" -ps -ef | grep docker | grep "default-ulimit" >/dev/null 2>&1 +$ps_command $ps_args | grep docker | grep "default-ulimit" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_10" else From d02a7f8c0ea4be6efb2e4b625e553eecedc3683b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 30 May 2015 13:02:08 +0200 Subject: [PATCH 4/8] Add Docker do_version_check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- tests/1_host_configuration.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/1_host_configuration.sh b/tests/1_host_configuration.sh index 49af272..62b917b 100644 --- a/tests/1_host_configuration.sh +++ b/tests/1_host_configuration.sh @@ -40,6 +40,7 @@ fi # 1.6 check_1_6="1.6 - Keep Docker up to date" docker_version=`docker version | grep 'Server version' | awk '{print $3}'` +do_version_check 1.6.2 $docker_version if [ $? -eq 11 ]; then warn "$check_1_6" else From d964e084fc045e34e9505c31b37bc4d122649971 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 30 May 2015 13:02:37 +0200 Subject: [PATCH 5/8] no need for cat when grepping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- tests/1_host_configuration.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/1_host_configuration.sh b/tests/1_host_configuration.sh index 62b917b..5265036 100644 --- a/tests/1_host_configuration.sh +++ b/tests/1_host_configuration.sh @@ -49,7 +49,7 @@ fi # 1.7 check_1_7="1.7 - Only allow trusted users to control Docker daemon" -docker_users=`cat /etc/group | grep docker` +docker_users=`grep docker /etc/group` info "$check_1_7" for u in $docker_users; do info " * $u" From 643beee453c3ec4014f563c58fa417b073caf433 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 30 May 2015 13:03:01 +0200 Subject: [PATCH 6/8] fail=1 when Docker exec fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- tests/5_container_runtime.sh | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/tests/5_container_runtime.sh b/tests/5_container_runtime.sh index 3cd9495..7ec7e4d 100644 --- a/tests/5_container_runtime.sh +++ b/tests/5_container_runtime.sh @@ -61,6 +61,13 @@ else fail=0 for c in $containers; do + exec_check=`docker exec $c ps -el 2>/dev/null` + if [ $? -eq 255 ]; then + warn "$check_5_3" + warn " * Docker exec fails: $c" + fail=1 + fi + processes=`docker exec $c ps -el 2>/dev/null | wc -l | awk '{print $1}'` if [ $processes -gt 5 ]; then # If it's the first container, fail the test @@ -165,8 +172,14 @@ else fail=0 for c in $containers; do - processes=`docker exec $c ps -el 2>/dev/null | grep sshd | wc -l | awk '{print $1}'` + exec_check=`docker exec $c ps -el 2>/dev/null` + if [ $? -eq 255 ]; then + warn "$check_5_7" + warn " * Docker exec failed: $c" + fail=1 + fi + processes=`docker exec $c ps -el 2>/dev/null | grep sshd | wc -l | awk '{print $1}'` if [ $processes -gt 1 ]; then # If it's the first container, fail the test if [ $fail -eq 0 ]; then From 9a35eb97d1eeae3e0c4cfda647ecd42ea100385e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sun, 31 May 2015 01:20:38 +0200 Subject: [PATCH 7/8] add /usr/local/bin to PATH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- docker-bench-security.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-bench-security.sh b/docker-bench-security.sh index 7b0c98f..575e52c 100644 --- a/docker-bench-security.sh +++ b/docker-bench-security.sh @@ -19,7 +19,7 @@ dir_name=`dirname ${this_path}` ## Dir where this file is myname=`basename ${this_path}` ## file name of this script. logger="${myname}.log" -export PATH=/bin:/sbin:/usr/bin +export PATH=/bin:/sbin:/usr/bin:/usr/local/bin # Check for required program(s) req_progs='docker netstat grep awk' From 4fcac56d34343a66fa78363940a9c70465d765fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sun, 31 May 2015 01:40:23 +0200 Subject: [PATCH 8/8] add /usr/sbin/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- docker-bench-security.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-bench-security.sh b/docker-bench-security.sh index 575e52c..a18b852 100644 --- a/docker-bench-security.sh +++ b/docker-bench-security.sh @@ -19,7 +19,7 @@ dir_name=`dirname ${this_path}` ## Dir where this file is myname=`basename ${this_path}` ## file name of this script. logger="${myname}.log" -export PATH=/bin:/sbin:/usr/bin:/usr/local/bin +export PATH=/bin:/sbin:/usr/bin:/usr/local/bin:/usr/sbin/ # Check for required program(s) req_progs='docker netstat grep awk'