mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-01-18 16:22:33 +01:00
first pass on section 1
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren
parent
7685c0417a
commit
6105f02a16
1 changed files with 160 additions and 140 deletions
|
|
@ -9,45 +9,34 @@ check_1() {
|
|||
startsectionjson "$id_1" "$desc_1"
|
||||
}
|
||||
|
||||
# 1.1
|
||||
check_1_1() {
|
||||
id_1_1="1.1"
|
||||
desc_1_1="Ensure a separate partition for containers has been created"
|
||||
check_1_1="$id_1_1 - $desc_1_1"
|
||||
starttestjson "$id_1_1" "$desc_1_1"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
if mountpoint -q -- "$(docker info -f '{{ .DockerRootDir }}')" >/dev/null 2>&1; then
|
||||
pass "$check_1_1"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_1"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
logit ""
|
||||
id_1_1="1_1"
|
||||
desc_1_1="General Configuration"
|
||||
check_1_1="$id_1_1 - $desc_1_1"
|
||||
info "$check_1_1"
|
||||
startsectionjson "$id_1_1" "$desc_1_1"
|
||||
}
|
||||
|
||||
# 1.2
|
||||
check_1_2() {
|
||||
id_1_2="1.2"
|
||||
desc_1_2="Ensure the container host has been Hardened"
|
||||
check_1_2="$id_1_2 - $desc_1_2"
|
||||
starttestjson "$id_1_2" "$desc_1_2"
|
||||
# 1.1.1
|
||||
check_1_1_1() {
|
||||
id_1_1_1="1.1.1"
|
||||
desc_1_1_1="Ensure the container host has been Hardened"
|
||||
check_1_1_1="$id_1_1_1 - $desc_1_1_1"
|
||||
starttestjson "$id_1_1_1" "$desc_1_1_1"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
note "$check_1_2"
|
||||
note "$check_1_1_1"
|
||||
resulttestjson "INFO"
|
||||
currentScore=$((currentScore + 0))
|
||||
}
|
||||
|
||||
# 1.3
|
||||
check_1_3() {
|
||||
id_1_3="1.3"
|
||||
desc_1_3="Ensure Docker is up to date"
|
||||
check_1_3="$id_1_3 - $desc_1_3"
|
||||
starttestjson "$id_1_3" "$desc_1_3"
|
||||
# 1.1.2
|
||||
check_1_1_2() {
|
||||
id_1_1_2="1.1.2"
|
||||
desc_1_1_2="Ensure Docker is up to date"
|
||||
check_1_1_2="$id_1_1_2 - $desc_1_1_2"
|
||||
starttestjson "$id_1_1_2" "$desc_1_1_2"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
docker_version=$(docker version | grep -i -A2 '^server' | grep ' Version:' \
|
||||
|
|
@ -55,13 +44,13 @@ check_1_3() {
|
|||
docker_current_version="$(date +%y.%m.0 -d @$(( $(date +%s) - 2592000)))"
|
||||
do_version_check "$docker_current_version" "$docker_version"
|
||||
if [ $? -eq 11 ]; then
|
||||
info "$check_1_3"
|
||||
info "$check_1_1_2"
|
||||
info " * Using $docker_version, verify is it up to date as deemed necessary"
|
||||
info " * Your operating system vendor may provide support and security maintenance for Docker"
|
||||
resulttestjson "INFO" "Using $docker_version"
|
||||
currentScore=$((currentScore + 0))
|
||||
else
|
||||
pass "$check_1_3"
|
||||
pass "$check_1_1_2"
|
||||
info " * Using $docker_version which is current"
|
||||
info " * Check with your operating system vendor for support and security maintenance for Docker"
|
||||
resulttestjson "PASS" "Using $docker_version"
|
||||
|
|
@ -69,16 +58,45 @@ check_1_3() {
|
|||
fi
|
||||
}
|
||||
|
||||
# 1.4
|
||||
check_1_4() {
|
||||
id_1_4="1.4"
|
||||
desc_1_4="Ensure only trusted users are allowed to control Docker daemon"
|
||||
check_1_4="$id_1_4 - $desc_1_4"
|
||||
starttestjson "$id_1_4" "$desc_1_4"
|
||||
check_1_2() {
|
||||
logit ""
|
||||
id_1_2="1_2"
|
||||
desc_1_2="Linux Hosts Specific Configuration"
|
||||
check_1_2="$id_1_2 - $desc_1_2"
|
||||
info "$check_1_2"
|
||||
startsectionjson "$id_1_2" "$desc_1_2"
|
||||
}
|
||||
|
||||
# 1.2.1
|
||||
check_1_2_1() {
|
||||
id_1_2_1="1.2.1"
|
||||
desc_1_2_1="Ensure a separate partition for containers has been created"
|
||||
check_1_2_1="$id_1_2_1 - $desc_1_2_1"
|
||||
starttestjson "$id_1_2_1" "$desc_1_2_1"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
if mountpoint -q -- "$(docker info -f '{{ .DockerRootDir }}')" >/dev/null 2>&1; then
|
||||
pass "$check_1_2_1"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_2_1"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.2.2
|
||||
check_1_2_2() {
|
||||
id_1_2_2="1.2.2"
|
||||
desc_1_2_2="Ensure only trusted users are allowed to control Docker daemon"
|
||||
check_1_2_2="$id_1_2_2 - $desc_1_2_2"
|
||||
starttestjson "$id_1_2_2" "$desc_1_2_2"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
docker_users=$(getent group docker)
|
||||
info "$check_1_4"
|
||||
info "$check_1_2_2"
|
||||
for u in $docker_users; do
|
||||
info " * $u"
|
||||
done
|
||||
|
|
@ -86,326 +104,328 @@ check_1_4() {
|
|||
currentScore=$((currentScore + 0))
|
||||
}
|
||||
|
||||
# 1.5
|
||||
check_1_5() {
|
||||
id_1_5="1.5"
|
||||
desc_1_5="Ensure auditing is configured for the Docker daemon"
|
||||
check_1_5="$id_1_5 - $desc_1_5"
|
||||
starttestjson "$id_1_5" "$desc_1_5"
|
||||
# 1.2.3
|
||||
check_1_2_3() {
|
||||
id_1_2_3="1.2.3"
|
||||
desc_1_2_3="Ensure auditing is configured for the Docker daemon"
|
||||
check_1_2_3="$id_1_2_3 - $desc_1_2_3"
|
||||
starttestjson "$id_1_2_3" "$desc_1_2_3"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="/usr/bin/docker "
|
||||
file="/usr/bin/dockerd"
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep "$file" >/dev/null 2>&1; then
|
||||
pass "$check_1_5"
|
||||
pass "$check_1_2_3"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_5"
|
||||
warn "$check_1_2_3"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_5"
|
||||
pass "$check_1_2_3"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_5"
|
||||
warn "$check_1_2_3"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.6
|
||||
check_1_6() {
|
||||
id_1_6="1.6"
|
||||
desc_1_6="Ensure auditing is configured for Docker files and directories - /var/lib/docker"
|
||||
check_1_6="$id_1_6 - $desc_1_6"
|
||||
starttestjson "$id_1_6" "$desc_1_6"
|
||||
# 1.2.4
|
||||
check_1_2_4() {
|
||||
id_1_2_4="1.2.4"
|
||||
desc_1_2_4="Ensure auditing is configured for Docker files and directories - /var/lib/docker"
|
||||
check_1_2_4="$id_1_2_4 - $desc_1_2_4"
|
||||
starttestjson "$id_1_2_4" "$desc_1_2_4"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
directory="/var/lib/docker"
|
||||
if [ -d "$directory" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep $directory >/dev/null 2>&1; then
|
||||
pass "$check_1_6"
|
||||
pass "$check_1_2_4"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_6"
|
||||
warn "$check_1_2_4"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_6"
|
||||
pass "$check_1_2_4"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_6"
|
||||
warn "$check_1_2_4"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_6"
|
||||
info "$check_1_2_4"
|
||||
info " * Directory not found"
|
||||
resulttestjson "INFO" "Directory not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.7
|
||||
check_1_7() {
|
||||
id_1_7="1.7"
|
||||
desc_1_7="Ensure auditing is configured for Docker files and directories - /etc/docker"
|
||||
check_1_7="$id_1_7 - $desc_1_7"
|
||||
starttestjson "$id_1_7" "$desc_1_7"
|
||||
# 1.2.5
|
||||
check_1_2_5() {
|
||||
id_1_2_5="1.2.5"
|
||||
desc_1_2_5="Ensure auditing is configured for Docker files and directories - /etc/docker"
|
||||
check_1_2_5="$id_1_2_5 - $desc_1_2_5"
|
||||
starttestjson "$id_1_2_5" "$desc_1_2_5"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
directory="/etc/docker"
|
||||
if [ -d "$directory" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep $directory >/dev/null 2>&1; then
|
||||
pass "$check_1_7"
|
||||
pass "$check_1_2_5"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_7"
|
||||
warn "$check_1_2_5"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_7"
|
||||
pass "$check_1_2_5"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_7"
|
||||
warn "$check_1_2_5"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_7"
|
||||
info "$check_1_2_5"
|
||||
info " * Directory not found"
|
||||
resulttestjson "INFO" "Directory not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.8
|
||||
check_1_8() {
|
||||
id_1_8="1.8"
|
||||
desc_1_8="Ensure auditing is configured for Docker files and directories - docker.service"
|
||||
check_1_8="$id_1_8 - $desc_1_8"
|
||||
starttestjson "$id_1_8" "$desc_1_8"
|
||||
# 1.2.6
|
||||
check_1_2_6() {
|
||||
id_1_2_6="1.2.6"
|
||||
desc_1_2_6="Ensure auditing is configured for Docker files and directories - docker.service"
|
||||
check_1_2_6="$id_1_2_6 - $desc_1_2_6"
|
||||
starttestjson "$id_1_2_6" "$desc_1_2_6"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="$(get_systemd_service_file docker.service)"
|
||||
if [ -f "$file" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep "$file" >/dev/null 2>&1; then
|
||||
pass "$check_1_8"
|
||||
pass "$check_1_2_6"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_8"
|
||||
warn "$check_1_2_6"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_8"
|
||||
pass "$check_1_2_6"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_8"
|
||||
warn "$check_1_2_6"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_8"
|
||||
info "$check_1_2_6"
|
||||
info " * File not found"
|
||||
resulttestjson "INFO" "File not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.9
|
||||
check_1_9() {
|
||||
id_1_9="1.9"
|
||||
desc_1_9="Ensure auditing is configured for Docker files and directories - docker.socket"
|
||||
check_1_9="$id_1_9 - $desc_1_9"
|
||||
starttestjson "$id_1_9" "$desc_1_9"
|
||||
# 1.2.7
|
||||
check_1_2_7() {
|
||||
id_1_2_7="1.2.7"
|
||||
desc_1_2_7="Ensure auditing is configured for Docker files and directories - docker.socket"
|
||||
check_1_2_7="$id_1_2_7 - $desc_1_2_7"
|
||||
starttestjson "$id_1_2_7" "$desc_1_2_7"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="$(get_systemd_service_file docker.socket)"
|
||||
if [ -e "$file" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep "$file" >/dev/null 2>&1; then
|
||||
pass "$check_1_9"
|
||||
pass "$check_1_2_7"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_9"
|
||||
warn "$check_1_2_7"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_9"
|
||||
pass "$check_1_2_7"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_9"
|
||||
warn "$check_1_2_7"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_9"
|
||||
info "$check_1_2_7"
|
||||
info " * File not found"
|
||||
resulttestjson "INFO" "File not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.10
|
||||
check_1_10() {
|
||||
id_1_10="1.10"
|
||||
desc_1_10="Ensure auditing is configured for Docker files and directories - /etc/default/docker"
|
||||
check_1_10="$id_1_10 - $desc_1_10"
|
||||
starttestjson "$id_1_10" "$desc_1_10"
|
||||
# 1.2.8
|
||||
check_1_2_8() {
|
||||
id_1_2_8="1.2.8"
|
||||
desc_1_2_8="Ensure auditing is configured for Docker files and directories - /etc/default/docker"
|
||||
check_1_2_8="$id_1_2_8 - $desc_1_2_8"
|
||||
starttestjson "$id_1_2_8" "$desc_1_2_8"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="/etc/default/docker"
|
||||
if [ -f "$file" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep $file >/dev/null 2>&1; then
|
||||
pass "$check_1_10"
|
||||
pass "$check_1_2_8"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_10"
|
||||
warn "$check_1_2_8"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_10"
|
||||
pass "$check_1_2_8"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_10"
|
||||
warn "$check_1_2_8"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_10"
|
||||
info "$check_1_2_8"
|
||||
info " * File not found"
|
||||
resulttestjson "INFO" "File not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.11
|
||||
check_1_11() {
|
||||
id_1_11="1.11"
|
||||
desc_1_11="Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json"
|
||||
check_1_11="$id_1_11 - $desc_1_11"
|
||||
starttestjson "$id_1_11" "$desc_1_11"
|
||||
# 1.2.9 Ensure auditing is configured for Docker files and directories -/etc/sysconfig/docker (Scored)
|
||||
|
||||
# 1.2.10
|
||||
check_1_2_10() {
|
||||
id_1_2_10="1.2.10"
|
||||
desc_1_2_10="Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json"
|
||||
check_1_2_10="$id_1_2_10 - $desc_1_2_10"
|
||||
starttestjson "$id_1_2_10" "$desc_1_2_10"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="/etc/docker/daemon.json"
|
||||
if [ -f "$file" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep $file >/dev/null 2>&1; then
|
||||
pass "$check_1_11"
|
||||
pass "$check_1_2_10"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_11"
|
||||
warn "$check_1_2_10"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_11"
|
||||
pass "$check_1_2_10"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_11"
|
||||
warn "$check_1_2_10"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_11"
|
||||
info "$check_1_2_10"
|
||||
info " * File not found"
|
||||
resulttestjson "INFO" "File not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.12
|
||||
check_1_12() {
|
||||
id_1_12="1.12"
|
||||
desc_1_12="Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd"
|
||||
check_1_12="$id_1_12 - $desc_1_12"
|
||||
starttestjson "$id_1_12" "$desc_1_12"
|
||||
# 1.2.11
|
||||
check_1_2_11() {
|
||||
id_1_2_11="1.2.11"
|
||||
desc_1_2_11="Ensure auditing is configured for Docker files and directories - /usr/bin/containerd"
|
||||
check_1_2_11="$id_1_2_11 - $desc_1_2_11"
|
||||
starttestjson "$id_1_2_11" "$desc_1_2_11"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="/usr/bin/docker-containerd"
|
||||
file="/usr/bin/containerd"
|
||||
if [ -f "$file" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep $file >/dev/null 2>&1; then
|
||||
pass "$check_1_12"
|
||||
pass "$check_1_2_11"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_12"
|
||||
warn "$check_1_2_11"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_12"
|
||||
pass "$check_1_2_11"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_12"
|
||||
warn "$check_1_2_11"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_12"
|
||||
info "$check_1_2_11"
|
||||
info " * File not found"
|
||||
resulttestjson "INFO" "File not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
}
|
||||
|
||||
# 1.13
|
||||
check_1_13() {
|
||||
id_1_13="1.13"
|
||||
desc_1_13="Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc"
|
||||
check_1_13="$id_1_13 - $desc_1_13"
|
||||
starttestjson "$id_1_13" "$desc_1_13"
|
||||
# 1.2.12
|
||||
check_1_2_12() {
|
||||
id_1_2_12="1.2.12"
|
||||
desc_1_2_12="Ensure auditing is configured for Docker files and directories - /usr/sbin/runc"
|
||||
check_1_2_12="$id_1_2_12 - $desc_1_2_12"
|
||||
starttestjson "$id_1_2_12" "$desc_1_2_12"
|
||||
|
||||
totalChecks=$((totalChecks + 1))
|
||||
file="/usr/bin/docker-runc"
|
||||
file="/usr/sbin/runc"
|
||||
if [ -f "$file" ]; then
|
||||
if command -v auditctl >/dev/null 2>&1; then
|
||||
if auditctl -l | grep $file >/dev/null 2>&1; then
|
||||
pass "$check_1_13"
|
||||
pass "$check_1_2_12"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_13"
|
||||
warn "$check_1_2_12"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
|
||||
pass "$check_1_13"
|
||||
pass "$check_1_2_12"
|
||||
resulttestjson "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
warn "$check_1_13"
|
||||
warn "$check_1_2_12"
|
||||
resulttestjson "WARN"
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
else
|
||||
info "$check_1_13"
|
||||
info "$check_1_2_12"
|
||||
info " * File not found"
|
||||
resulttestjson "INFO" "File not found"
|
||||
currentScore=$((currentScore + 0))
|
||||
|
|
|
|||
Loading…
Reference in a new issue