mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-01-18 16:22:33 +01:00
replace ls with stat when checking owner and perms
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren
parent
820bb581b7
commit
70b8d33cef
1 changed files with 19 additions and 38 deletions
|
|
@ -7,8 +7,7 @@ info "3 - Docker Daemon Configuration Files"
|
|||
check_3_1="3.1 - Verify that docker.service file ownership is set to root:root"
|
||||
file="/usr/lib/systemd/system/docker.service"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_1"
|
||||
else
|
||||
warn "$check_3_1"
|
||||
|
|
@ -23,8 +22,7 @@ fi
|
|||
check_3_2="3.2 - Verify that docker.service file permissions are set to 644"
|
||||
file="/usr/lib/systemd/system/docker.service"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_2"
|
||||
else
|
||||
warn "$check_3_2"
|
||||
|
|
@ -39,8 +37,7 @@ fi
|
|||
check_3_3="3.3 - Verify that docker-registry.service file ownership is set to root:root"
|
||||
file="/usr/lib/systemd/system/docker-registry.service"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_3"
|
||||
else
|
||||
warn "$check_3_3"
|
||||
|
|
@ -55,8 +52,7 @@ fi
|
|||
check_3_4="3.4 - Verify that docker-registry.service file permissions are set to 644"
|
||||
file="/usr/lib/systemd/system/docker-registry.service"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_4"
|
||||
else
|
||||
warn "$check_3_4"
|
||||
|
|
@ -71,8 +67,7 @@ fi
|
|||
check_3_5="3.5 - Verify that docker.socket file ownership is set to root:root"
|
||||
file="/usr/lib/systemd/system/docker.socket"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_5"
|
||||
else
|
||||
warn "$check_3_5"
|
||||
|
|
@ -87,8 +82,7 @@ fi
|
|||
check_3_6="3.6 - Verify that docker.socket file permissions are set to 644"
|
||||
file="/usr/lib/systemd/system/docker.socket"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_6"
|
||||
else
|
||||
warn "$check_3_6"
|
||||
|
|
@ -103,8 +97,7 @@ fi
|
|||
check_3_7="3.7 - Verify that Docker environment file ownership is set to root:root "
|
||||
file="/etc/sysconfig/docker"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_7"
|
||||
else
|
||||
warn "$check_3_7"
|
||||
|
|
@ -119,8 +112,7 @@ fi
|
|||
check_3_8="3.8 - Verify that Docker environment file permissions are set to 644"
|
||||
file="/etc/sysconfig/docker"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_8"
|
||||
else
|
||||
warn "$check_3_8"
|
||||
|
|
@ -135,8 +127,7 @@ fi
|
|||
check_3_9="3.9 - Verify that docker-network environment file ownership is set to root:root"
|
||||
file="/etc/sysconfig/docker-network"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_9"
|
||||
else
|
||||
warn "$check_3_9"
|
||||
|
|
@ -151,8 +142,7 @@ fi
|
|||
check_3_10="3.10 - Verify that docker-network environment file permissions are set to 644"
|
||||
file="/etc/sysconfig/docker-network"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_10"
|
||||
else
|
||||
warn "$check_3_10"
|
||||
|
|
@ -167,8 +157,7 @@ fi
|
|||
check_3_11="3.11 - Verify that docker-registry environment file ownership is set to root:root"
|
||||
file="/etc/sysconfig/docker-registry"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_11"
|
||||
else
|
||||
warn "$check_3_11"
|
||||
|
|
@ -183,8 +172,7 @@ fi
|
|||
check_3_12="3.12 - Verify that docker-registry environment file permissions are set to 644"
|
||||
file="/etc/sysconfig/docker-registry"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_12"
|
||||
else
|
||||
warn "$check_3_12"
|
||||
|
|
@ -199,8 +187,7 @@ fi
|
|||
check_3_13="3.13 - Verify that docker-storage environment file ownership is set to root:root"
|
||||
file="/etc/sysconfig/docker-storage"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_13"
|
||||
else
|
||||
warn "$check_3_13"
|
||||
|
|
@ -215,8 +202,7 @@ fi
|
|||
check_3_14="3.14 - Verify that docker-storage environment file permissions are set to 644"
|
||||
file="/etc/sysconfig/docker-storage"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %a $file)" -eq 644 ]; then
|
||||
pass "$check_3_14"
|
||||
else
|
||||
warn "$check_3_14"
|
||||
|
|
@ -231,8 +217,7 @@ fi
|
|||
check_3_15="3.15 - Verify that /etc/docker directory ownership is set to root:root"
|
||||
directory="/etc/docker"
|
||||
if [ -d "$directory" ]; then
|
||||
ls -ld "$directory" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $directory)" -eq 00 ]; then
|
||||
pass "$check_3_15"
|
||||
else
|
||||
warn "$check_3_15"
|
||||
|
|
@ -310,8 +295,7 @@ fi
|
|||
check_3_19="3.19 - Verify that TLS CA certificate file ownership is set to root:root"
|
||||
tlscacert=$(pgrep -lf docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1)
|
||||
if [ -f "$tlscacert" ]; then
|
||||
ls -ld "$tlscacert" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_19"
|
||||
else
|
||||
warn "$check_3_19"
|
||||
|
|
@ -342,8 +326,7 @@ fi
|
|||
check_3_21="3.21 - Verify that Docker server certificate file ownership is set to root:root"
|
||||
tlscert=$(pgrep -lf docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1)
|
||||
if [ -f "$tlscert" ]; then
|
||||
ls -ld "$tlscert" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_21"
|
||||
else
|
||||
warn "$check_3_21"
|
||||
|
|
@ -374,8 +357,7 @@ fi
|
|||
check_3_23="3.23 - Verify that Docker server key file ownership is set to root:root"
|
||||
tlskey=$(pgrep -lf docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1)
|
||||
if [ -f "$tlskey" ]; then
|
||||
ls -ld "$tlskey" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_23"
|
||||
else
|
||||
warn "$check_3_23"
|
||||
|
|
@ -406,8 +388,7 @@ fi
|
|||
check_3_25="3.25 - Verify that Docker socket file ownership is set to root:docker"
|
||||
file="/var/run/docker.sock"
|
||||
if [ -f "$file" ]; then
|
||||
ls -ld "$file" | awk '{print $3, $4}' | grep "root docker" >/dev/null 2>&1
|
||||
if [ $? -eq 0 ]; then
|
||||
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
|
||||
pass "$check_3_25"
|
||||
else
|
||||
warn "$check_3_25"
|
||||
|
|
|
|||
Loading…
Reference in a new issue