GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

fixed shellcheck issues and check_5_29 for excludes

Browse source 
Signed-off-by: Mike Ritter <mike.ritter@target.com>
This commit is contained in:
Mike Ritter 2018-02-24 00:07:47 -06:00
parent 41a9e0d1f9
commit 6e0460db5a
2 changed files with 13 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
docker-bench-security.sh
View file

@ -88,10 +88,10 @@ beginjson "1.3.4" "$(date +%s)"
# Load all the tests from tests/ and run them
main () {
# List all running containers
if [ -z $exclude ]; then
if [ -z "$exclude" ]; then
containers=$(docker ps | sed '1d' | awk '{print $NF}')
else
pattern=$(echo $exclude | sed 's/,/|/g')
pattern=$(echo "$exclude" | sed 's/,/|/g')
containers=$(docker ps | sed '1d' | grep -Ev '$pattern' | awk '{print $NF}')
fi
# If there is a container with label docker_bench_security, memorize it:
@ -103,10 +103,10 @@ main () {
fi
done
# List all running containers except docker-bench (use names to improve readability in logs)
if [ -z $exclude ]; then
if [ -z "$exclude" ]; then
containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont")
else
pattern=$(echo $exclude | sed 's/,/|/g')
pattern=$(echo "$exclude" | sed 's/,/|/g')
containers=$(docker ps | sed '1d' | grep -Ev "$pattern" | awk '{print $NF}' | grep -v "$benchcont")
fi
@ -124,7 +124,7 @@ main () {
if [ -z "$check" ]; then
cis
else
for i in $(echo $check | sed "s/,/ /g")
for i in $(echo "$check" | sed "s/,/ /g")
do
if command -v "$i" 2>/dev/null 1>&2; then
"$i"

7
tests/5_container_runtime.sh
View file

@ -989,6 +989,7 @@ check_5_29() {
if docker network inspect --format '{{ .Options }}' "$net" 2>/dev/null | grep "com.docker.network.bridge.name:docker0" >/dev/null 2>&1; then
docker0Containers=$(docker network inspect --format='{{ range $k, $v := .Containers }} {{ $k }} {{ end }}' "$net" | \
sed -e 's/^ //' -e 's/ /\n/g' 2>/dev/null)
if [ -n "$docker0Containers" ]; then
if [ $fail -eq 0 ]; then
info "$check_5_29"
@ -996,7 +997,12 @@ check_5_29() {
fail=1
fi
for c in $docker0Containers; do
if [ -z "$exclude" ]; then
cName=$(docker inspect --format '{{.Name}}' "$c" 2>/dev/null | sed 's/\///g')
else
pattern=$(echo "$exclude" | sed 's/,/|/g')
cName=$(docker inspect --format '{{.Name}}' "$c" 2>/dev/null | sed 's/\///g' | grep -Ev '$pattern' )
fi
info " * Container in docker0 network: $cName"
logjson "5.29" "INFO: $c"
done
@ -1081,4 +1087,3 @@ check_5_31() {
currentScore=$((currentScore - 1))
fi
}