GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 08:42:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

fixed shellcheck issues and check_5_29 for excludes

Browse source 
Signed-off-by: Mike Ritter <mike.ritter@target.com>
This commit is contained in:
Mike Ritter 2018-02-24 00:07:47 -06:00
parent 41a9e0d1f9
commit 6e0460db5a
2 changed files with 13 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
docker-bench-security.sh
View file

@ -88,10 +88,10 @@ beginjson "1.3.4" "$(date +%s)"
# Load all the tests from tests/ and run them # Load all the tests from tests/ and run them
main () { main () {
# List all running containers # List all running containers
if [ -z $exclude ]; then if [ -z "$exclude" ]; then
containers=$(docker ps | sed '1d' | awk '{print $NF}') containers=$(docker ps | sed '1d' | awk '{print $NF}')
else else
pattern=$(echo $exclude | sed 's/,/|/g') pattern=$(echo "$exclude" | sed 's/,/|/g')
containers=$(docker ps | sed '1d' | grep -Ev '$pattern' | awk '{print $NF}') containers=$(docker ps | sed '1d' | grep -Ev '$pattern' | awk '{print $NF}')
fi fi
# If there is a container with label docker_bench_security, memorize it: # If there is a container with label docker_bench_security, memorize it:
@ -103,10 +103,10 @@ main () {
fi fi
done done
# List all running containers except docker-bench (use names to improve readability in logs) # List all running containers except docker-bench (use names to improve readability in logs)
if [ -z $exclude ]; then if [ -z "$exclude" ]; then
containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont") containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont")
else else
pattern=$(echo $exclude | sed 's/,/|/g') pattern=$(echo "$exclude" | sed 's/,/|/g')
containers=$(docker ps | sed '1d' | grep -Ev "$pattern" | awk '{print $NF}' | grep -v "$benchcont") containers=$(docker ps | sed '1d' | grep -Ev "$pattern" | awk '{print $NF}' | grep -v "$benchcont")
fi fi
@ -124,7 +124,7 @@ main () {
if [ -z "$check" ]; then if [ -z "$check" ]; then
cis cis
else else
for i in $(echo $check | sed "s/,/ /g") for i in $(echo "$check" | sed "s/,/ /g")
do do
if command -v "$i" 2>/dev/null 1>&2; then if command -v "$i" 2>/dev/null 1>&2; then
"$i" "$i"

7
tests/5_container_runtime.sh
View file

@ -989,6 +989,7 @@ check_5_29() {
if docker network inspect --format '{{ .Options }}' "$net" 2>/dev/null | grep "com.docker.network.bridge.name:docker0" >/dev/null 2>&1; then if docker network inspect --format '{{ .Options }}' "$net" 2>/dev/null | grep "com.docker.network.bridge.name:docker0" >/dev/null 2>&1; then
docker0Containers=$(docker network inspect --format='{{ range $k, $v := .Containers }} {{ $k }} {{ end }}' "$net" | \ docker0Containers=$(docker network inspect --format='{{ range $k, $v := .Containers }} {{ $k }} {{ end }}' "$net" | \
sed -e 's/^ //' -e 's/ /\n/g' 2>/dev/null) sed -e 's/^ //' -e 's/ /\n/g' 2>/dev/null)
if [ -n "$docker0Containers" ]; then if [ -n "$docker0Containers" ]; then
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
info "$check_5_29" info "$check_5_29"
@ -996,7 +997,12 @@ check_5_29() {
fail=1 fail=1
fi fi
for c in $docker0Containers; do for c in $docker0Containers; do
if [ -z "$exclude" ]; then
cName=$(docker inspect --format '{{.Name}}' "$c" 2>/dev/null | sed 's/\///g') cName=$(docker inspect --format '{{.Name}}' "$c" 2>/dev/null | sed 's/\///g')
else
pattern=$(echo "$exclude" | sed 's/,/|/g')
cName=$(docker inspect --format '{{.Name}}' "$c" 2>/dev/null | sed 's/\///g' | grep -Ev '$pattern' )
fi
info " * Container in docker0 network: $cName" info " * Container in docker0 network: $cName"
logjson "5.29" "INFO: $c" logjson "5.29" "INFO: $c"
done done
@ -1081,4 +1087,3 @@ check_5_31() {
currentScore=$((currentScore - 1)) currentScore=$((currentScore - 1))
fi fi
} }