From 81b093632a789312c26b28cdaef555d2912777f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Fri, 15 Apr 2016 00:22:52 +0200
Subject: [PATCH] update chap 6 to cis 1.11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 tests/6_docker_security_operations.sh | 53 ++++-----------------------
 1 file changed, 8 insertions(+), 45 deletions(-)

diff --git a/tests/6_docker_security_operations.sh b/tests/6_docker_security_operations.sh
index 27c3840..2af3edd 100644
--- a/tests/6_docker_security_operations.sh
+++ b/tests/6_docker_security_operations.sh
@@ -3,45 +3,8 @@
 logit "\n"
 info "6  - Docker Security Operations"
 
-# 6.5
-check_6_5="6.5 - Use a centralized and remote log collection service"
-
-# If containers is empty, there are no running containers
-if [ -z "$containers" ]; then
-  info "$check_6_5"
-  info "     * No containers running"
-else
-  fail=0
-  set -f; IFS=$'
-'
-  for c in $containers; do
-    docker inspect --format '{{ .Volumes }}' "$c" 2>/dev/null 1>&2
-
-    if [ $? -eq 0 ]; then
-      volumes=$(docker inspect --format '{{ .Volumes }}' "$c")
-    else
-      volumes=$(docker inspect --format '{{ .Config.Volumes }}' "$c")
-    fi
-
-    if [ "$volumes" = "map[]" ]; then
-      # If it's the first container, fail the test
-      if [ $fail -eq 0 ]; then
-        info "$check_6_5"
-        info "     * Container has no volumes, ensure centralized logging is enabled : $c"
-        fail=1
-      else
-        info "     * Container has no volumes, ensure centralized logging is enabled : $c"
-      fi
-    fi
-  done
-  # Only alert if there are no volumes. If there are volumes, can't know if they
-  # are used for logs
-fi
-# Make the loop separator go back to space
-set +f; unset IFS
-
-# 6.6
-check_6_6="6.6 - Avoid image sprawl"
+# 6.4
+check_6_4="6.4 - Avoid image sprawl"
 images=$(docker images -q | sort -u | wc -l | awk '{print $1}')
 active_images=0
 
@@ -52,10 +15,10 @@ for c in $(docker inspect -f "{{.Image}}" $(docker ps -qa)); do
 done
 
 if [ "$images" -gt 100 ]; then
-  warn "$check_6_6"
+  warn "$check_6_4"
   warn "     * There are currently: $images images"
 else
-  info "$check_6_6"
+  info "$check_6_4"
   info "     * There are currently: $images images"
 fi
 
@@ -63,15 +26,15 @@ if [ "$active_images" -lt "$((images / 2))" ]; then
   warn "     * Only $active_images out of $images are in use"
 fi
 
-# 6.7
-check_6_7="6.7 - Avoid container sprawl"
+# 6.5
+check_6_5="6.5 - Avoid container sprawl"
 total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}')
 running_containers=$(docker ps -q | wc -l | awk '{print $1}')
 diff="$((total_containers - running_containers))"
 if [ "$diff" -gt 25 ]; then
-  warn "$check_6_7"
+  warn "$check_6_5"
   warn "     * There are currently a total of $total_containers containers, with only $running_containers of them currently running"
 else
-  info "$check_6_7"
+  info "$check_6_5"
   info "     * There are currently a total of $total_containers containers, with $running_containers of them currently running"
 fi