GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-10-24 23:26:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

replace ls with stat when checking owner and perms

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2015-06-17 23:25:01 +02:00
commit 70b8d33cef
1 changed files with 19 additions and 38 deletions

57
tests/3_docker_daemon_configuration_files.sh
View file

@ -7,8 +7,7 @@ info "3 - Docker Daemon Configuration Files"
check_3_1="3.1 - Verify that docker.service file ownership is set to root:root"
file="/usr/lib/systemd/system/docker.service"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_1"
else
warn "$check_3_1"
@ -23,8 +22,7 @@ fi
check_3_2="3.2 - Verify that docker.service file permissions are set to 644"
file="/usr/lib/systemd/system/docker.service"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_2"
else
warn "$check_3_2"
@ -39,8 +37,7 @@ fi
check_3_3="3.3 - Verify that docker-registry.service file ownership is set to root:root"
file="/usr/lib/systemd/system/docker-registry.service"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_3"
else
warn "$check_3_3"
@ -55,8 +52,7 @@ fi
check_3_4="3.4 - Verify that docker-registry.service file permissions are set to 644"
file="/usr/lib/systemd/system/docker-registry.service"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_4"
else
warn "$check_3_4"
@ -71,8 +67,7 @@ fi
check_3_5="3.5 - Verify that docker.socket file ownership is set to root:root"
file="/usr/lib/systemd/system/docker.socket"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_5"
else
warn "$check_3_5"
@ -87,8 +82,7 @@ fi
check_3_6="3.6 - Verify that docker.socket file permissions are set to 644"
file="/usr/lib/systemd/system/docker.socket"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_6"
else
warn "$check_3_6"
@ -103,8 +97,7 @@ fi
check_3_7="3.7 - Verify that Docker environment file ownership is set to root:root "
file="/etc/sysconfig/docker"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_7"
else
warn "$check_3_7"
@ -119,8 +112,7 @@ fi
check_3_8="3.8 - Verify that Docker environment file permissions are set to 644"
file="/etc/sysconfig/docker"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_8"
else
warn "$check_3_8"
@ -135,8 +127,7 @@ fi
check_3_9="3.9 - Verify that docker-network environment file ownership is set to root:root"
file="/etc/sysconfig/docker-network"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_9"
else
warn "$check_3_9"
@ -151,8 +142,7 @@ fi
check_3_10="3.10 - Verify that docker-network environment file permissions are set to 644"
file="/etc/sysconfig/docker-network"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_10"
else
warn "$check_3_10"
@ -167,8 +157,7 @@ fi
check_3_11="3.11 - Verify that docker-registry environment file ownership is set to root:root"
file="/etc/sysconfig/docker-registry"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_11"
else
warn "$check_3_11"
@ -183,8 +172,7 @@ fi
check_3_12="3.12 - Verify that docker-registry environment file permissions are set to 644"
file="/etc/sysconfig/docker-registry"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_12"
else
warn "$check_3_12"
@ -199,8 +187,7 @@ fi
check_3_13="3.13 - Verify that docker-storage environment file ownership is set to root:root"
file="/etc/sysconfig/docker-storage"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_13"
else
warn "$check_3_13"
@ -215,8 +202,7 @@ fi
check_3_14="3.14 - Verify that docker-storage environment file permissions are set to 644"
file="/etc/sysconfig/docker-storage"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $1}' | grep "rw-r--r--" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %a $file)" -eq 644 ]; then
pass "$check_3_14"
else
warn "$check_3_14"
@ -231,8 +217,7 @@ fi
check_3_15="3.15 - Verify that /etc/docker directory ownership is set to root:root"
directory="/etc/docker"
if [ -d "$directory" ]; then
ls -ld "$directory" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $directory)" -eq 00 ]; then
pass "$check_3_15"
else
warn "$check_3_15"
@ -310,8 +295,7 @@ fi
check_3_19="3.19 - Verify that TLS CA certificate file ownership is set to root:root"
tlscacert=$(pgrep -lf docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | cut -d " " -f 1)
if [ -f "$tlscacert" ]; then
ls -ld "$tlscacert" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_19"
else
warn "$check_3_19"
@ -342,8 +326,7 @@ fi
check_3_21="3.21 - Verify that Docker server certificate file ownership is set to root:root"
tlscert=$(pgrep -lf docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | cut -d " " -f 1)
if [ -f "$tlscert" ]; then
ls -ld "$tlscert" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_21"
else
warn "$check_3_21"
@ -374,8 +357,7 @@ fi
check_3_23="3.23 - Verify that Docker server key file ownership is set to root:root"
tlskey=$(pgrep -lf docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | cut -d " " -f 1)
if [ -f "$tlskey" ]; then
ls -ld "$tlskey" | awk '{print $3, $4}' | grep "root root" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_23"
else
warn "$check_3_23"
@ -406,8 +388,7 @@ fi
check_3_25="3.25 - Verify that Docker socket file ownership is set to root:docker"
file="/var/run/docker.sock"
if [ -f "$file" ]; then
ls -ld "$file" | awk '{print $3, $4}' | grep "root docker" >/dev/null 2>&1
if [ $? -eq 0 ]; then
if [ "$(stat -c %u%g $file)" -eq 00 ]; then
pass "$check_3_25"
else
warn "$check_3_25"