GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-07-27 04:57:50 +00:00
Code Issues Projects Releases Packages Wiki Activity

Change global variable used only locally to local variable for simplification

Browse source
This commit is contained in:
Razvan Stoica 2021-03-09 12:42:48 +02:00
parent 4b4fdd9f77
commit 94900eedb9
10 changed files with 829 additions and 826 deletions

258
tests/2_docker_daemon_configuration.sh
View file

@ -2,31 +2,31 @@
check_2() {
logit "\n"
id_2="2"
desc_2="Docker daemon configuration"
check_2="$id_2 - $desc_2"
info "$check_2"
startsectionjson "$id_2" "$desc_2"
local id="2"
local desc="Docker daemon configuration"
local check="$id - $desc"
info "$check"
startsectionjson "$id" "$desc"
}
# 2.1
check_2_1() {
id_2_1="2.1"
desc_2_1="Ensure network traffic is restricted between containers on the default bridge (Scored)"
check_2_1="$id_2_1 - $desc_2_1"
starttestjson "$id_2_1" "$desc_2_1"
local id="2.1"
local desc="Ensure network traffic is restricted between containers on the default bridge (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_effective_command_line_args '--icc' | grep false >/dev/null 2>&1; then
pass "$check_2_1"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_configuration_file_args 'icc' | grep "false" >/dev/null 2>&1; then
pass "$check_2_1"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_1"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
@ -34,38 +34,38 @@ check_2_1() {
# 2.2
check_2_2() {
id_2_2="2.2"
desc_2_2="Ensure the logging level is set to 'info' (Scored)"
check_2_2="$id_2_2 - $desc_2_2"
starttestjson "$id_2_2" "$desc_2_2"
local id="2.2"
local desc="Ensure the logging level is set to 'info' (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'log-level' >/dev/null 2>&1; then
if get_docker_configuration_file_args 'log-level' | grep info >/dev/null 2>&1; then
pass "$check_2_2"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif [ -z "$(get_docker_configuration_file_args 'log-level')" ]; then
pass "$check_2_2"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_2"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
elif get_docker_effective_command_line_args '-l'; then
if get_docker_effective_command_line_args '-l' | grep "info" >/dev/null 2>&1; then
pass "$check_2_2"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_2"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
else
pass "$check_2_2"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -73,22 +73,22 @@ check_2_2() {
# 2.3
check_2_3() {
id_2_3="2.3"
desc_2_3="Ensure Docker is allowed to make changes to iptables (Scored)"
check_2_3="$id_2_3 - $desc_2_3"
starttestjson "$id_2_3" "$desc_2_3"
local id="2.3"
local desc="Ensure Docker is allowed to make changes to iptables (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_effective_command_line_args '--iptables' | grep "false" >/dev/null 2>&1; then
warn "$check_2_3"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
elif get_docker_configuration_file_args 'iptables' | grep "false" >/dev/null 2>&1; then
warn "$check_2_3"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
else
pass "$check_2_3"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -96,28 +96,28 @@ check_2_3() {
# 2.4
check_2_4() {
id_2_4="2.4"
desc_2_4="Ensure insecure registries are not used (Scored)"
check_2_4="$id_2_4 - $desc_2_4"
starttestjson "$id_2_4" "$desc_2_4"
local id="2.4"
local desc="Ensure insecure registries are not used (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_effective_command_line_args '--insecure-registry' | grep "insecure-registry" >/dev/null 2>&1; then
warn "$check_2_4"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
elif ! [ -z "$(get_docker_configuration_file_args 'insecure-registries')" ]; then
if get_docker_configuration_file_args 'insecure-registries' | grep '\[]' >/dev/null 2>&1; then
pass "$check_2_4"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_4"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
else
pass "$check_2_4"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -125,18 +125,18 @@ check_2_4() {
# 2.5
check_2_5() {
id_2_5="2.5"
desc_2_5="Ensure aufs storage driver is not used (Scored)"
check_2_5="$id_2_5 - $desc_2_5"
starttestjson "$id_2_5" "$desc_2_5"
local id="2.5"
local desc="Ensure aufs storage driver is not used (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if docker info 2>/dev/null | grep -e "^\sStorage Driver:\s*aufs\s*$" >/dev/null 2>&1; then
warn "$check_2_5"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
else
pass "$check_2_5"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -144,33 +144,33 @@ check_2_5() {
# 2.6
check_2_6() {
id_2_6="2.6"
desc_2_6="Ensure TLS authentication for Docker daemon is configured (Scored)"
check_2_6="$id_2_6 - $desc_2_6"
starttestjson "$id_2_6" "$desc_2_6"
local id="2.6"
local desc="Ensure TLS authentication for Docker daemon is configured (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if [ $(get_docker_configuration_file_args 'tcp://') ] || \
[ $(get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://') >/dev/null 2>&1 ]; then
if [ $(get_docker_configuration_file_args '"tlsverify":' | grep 'true') ] || \
[ $(get_docker_cumulative_command_line_args '--tlsverify' | grep 'tlsverify') >/dev/null 2>&1 ]; then
pass "$check_2_6"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif [ $(get_docker_configuration_file_args '"tls":' | grep 'true') ] || \
[ $(get_docker_cumulative_command_line_args '--tls' | grep 'tls$') >/dev/null 2>&1 ]; then
warn "$check_2_6"
warn "$check"
warn " * Docker daemon currently listening on TCP with TLS, but no verification"
resulttestjson "WARN" "Docker daemon currently listening on TCP with TLS, but no verification"
currentScore=$((currentScore - 1))
else
warn "$check_2_6"
warn "$check"
warn " * Docker daemon currently listening on TCP without TLS"
resulttestjson "WARN" "Docker daemon currently listening on TCP without TLS"
currentScore=$((currentScore - 1))
fi
else
info "$check_2_6"
info "$check"
info " * Docker daemon not listening on TCP"
resulttestjson "INFO" "Docker daemon not listening on TCP"
currentScore=$((currentScore + 0))
@ -179,22 +179,22 @@ check_2_6() {
# 2.7
check_2_7() {
id_2_7="2.7"
desc_2_7="Ensure the default ulimit is configured appropriately (Not Scored)"
check_2_7="$id_2_7 - $desc_2_7"
starttestjson "$id_2_7" "$desc_2_7"
local id="2.7"
local desc="Ensure the default ulimit is configured appropriately (Not Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'default-ulimit' | grep -v '{}' >/dev/null 2>&1; then
pass "$check_2_7"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1; then
pass "$check_2_7"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
info "$check_2_7"
info "$check"
info " * Default ulimit doesn't appear to be set"
resulttestjson "INFO" "Default ulimit doesn't appear to be set"
currentScore=$((currentScore + 0))
@ -203,22 +203,22 @@ check_2_7() {
# 2.8
check_2_8() {
id_2_8="2.8"
desc_2_8="Enable user namespace support (Scored)"
check_2_8="$id_2_8 - $desc_2_8"
starttestjson "$id_2_8" "$desc_2_8"
local id="2.8"
local desc="Enable user namespace support (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'userns-remap' | grep -v '""'; then
pass "$check_2_8"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_effective_command_line_args '--userns-remap' | grep "userns-remap" >/dev/null 2>&1; then
pass "$check_2_8"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_8"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
@ -226,24 +226,24 @@ check_2_8() {
# 2.9
check_2_9() {
id_2_9="2.9"
desc_2_9="Ensure the default cgroup usage has been confirmed (Scored)"
check_2_9="$id_2_9 - $desc_2_9"
starttestjson "$id_2_9" "$desc_2_9"
local id="2.9"
local desc="Ensure the default cgroup usage has been confirmed (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'cgroup-parent' | grep -v ''; then
warn "$check_2_9"
warn "$check"
info " * Confirm cgroup usage"
resulttestjson "WARN" "Confirm cgroup usage"
currentScore=$((currentScore + 0))
elif get_docker_effective_command_line_args '--cgroup-parent' | grep "cgroup-parent" >/dev/null 2>&1; then
warn "$check_2_9"
warn "$check"
info " * Confirm cgroup usage"
resulttestjson "WARN" "Confirm cgroup usage"
currentScore=$((currentScore + 0))
else
pass "$check_2_9"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -251,22 +251,22 @@ check_2_9() {
# 2.10
check_2_10() {
id_2_10="2.10"
desc_2_10="Ensure base device size is not changed until needed (Scored)"
check_2_10="$id_2_10 - $desc_2_10"
starttestjson "$id_2_10" "$desc_2_10"
local id="2.10"
local desc="Ensure base device size is not changed until needed (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'storage-opts' | grep "dm.basesize" >/dev/null 2>&1; then
warn "$check_2_10"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
elif get_docker_effective_command_line_args '--storage-opt' | grep "dm.basesize" >/dev/null 2>&1; then
warn "$check_2_10"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
else
pass "$check_2_10"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -274,22 +274,22 @@ check_2_10() {
# 2.11
check_2_11() {
id_2_11="2.11"
desc_2_11="Ensure that authorization for Docker client commands is enabled (Scored)"
check_2_11="$id_2_11 - $desc_2_11"
starttestjson "$id_2_11" "$desc_2_11"
local id="2.11"
local desc="Ensure that authorization for Docker client commands is enabled (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'authorization-plugins' | grep -v '\[]'; then
pass "$check_2_11"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_effective_command_line_args '--authorization-plugin' | grep "authorization-plugin" >/dev/null 2>&1; then
pass "$check_2_11"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_11"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
@ -297,18 +297,18 @@ check_2_11() {
# 2.12
check_2_12() {
id_2_12="2.12"
desc_2_12="Ensure centralized and remote logging is configured (Scored)"
check_2_12="$id_2_12 - $desc_2_12"
starttestjson "$id_2_12" "$desc_2_12"
local id="2.12"
local desc="Ensure centralized and remote logging is configured (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if docker info --format '{{ .LoggingDriver }}' | grep 'json-file' >/dev/null 2>&1; then
warn "$check_2_12"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
else
pass "$check_2_12"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
fi
@ -316,27 +316,27 @@ check_2_12() {
# 2.13
check_2_13() {
id_2_13="2.13"
desc_2_13="Ensure live restore is enabled (Scored)"
check_2_13="$id_2_13 - $desc_2_13"
starttestjson "$id_2_13" "$desc_2_13"
local id="2.13"
local desc="Ensure live restore is enabled (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if docker info 2>/dev/null | grep -e "Live Restore Enabled:\s*true\s*" >/dev/null 2>&1; then
pass "$check_2_13"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
if docker info 2>/dev/null | grep -e "Swarm:*\sactive\s*" >/dev/null 2>&1; then
pass "$check_2_13 (Incompatible with swarm mode)"
pass "$check (Incompatible with swarm mode)"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_effective_command_line_args '--live-restore' | grep "live-restore" >/dev/null 2>&1; then
pass "$check_2_13"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_13"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
@ -345,22 +345,22 @@ check_2_13() {
# 2.14
check_2_14() {
id_2_14="2.14"
desc_2_14="Ensure Userland Proxy is Disabled (Scored)"
check_2_14="$id_2_14 - $desc_2_14"
starttestjson "$id_2_14" "$desc_2_14"
local id="2.14"
local desc="Ensure Userland Proxy is Disabled (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_configuration_file_args 'userland-proxy' | grep false >/dev/null 2>&1; then
pass "$check_2_14"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_effective_command_line_args '--userland-proxy=false' 2>/dev/null | grep "userland-proxy=false" >/dev/null 2>&1; then
pass "$check_2_14"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_14"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
@ -368,18 +368,18 @@ check_2_14() {
# 2.15
check_2_15() {
id_2_15="2.15"
desc_2_15="Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Not Scored)"
check_2_15="$id_2_15 - $desc_2_15"
starttestjson "$id_2_15" "$desc_2_15"
local id="2.15"
local desc="Ensure that a daemon-wide custom seccomp profile is applied if appropriate (Not Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if docker info --format '{{ .SecurityOptions }}' | grep 'name=seccomp,profile=default' 2>/dev/null 1>&2; then
pass "$check_2_15"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
info "$check_2_15"
info "$check"
resulttestjson "INFO"
currentScore=$((currentScore + 0))
fi
@ -390,48 +390,48 @@ check_2_16() {
docker_version=$(docker version | grep -i -A2 '^server' | grep ' Version:' \
| awk '{print $NF; exit}' | tr -d '[:alpha:]-,.' | cut -c 1-4)
id_2_16="2.16"
desc_2_16="Ensure that experimental features are not implemented in production (Scored)"
check_2_16="$id_2_16 - $desc_2_16"
starttestjson "$id_2_16" "$desc_2_16"
local id="2.16"
local desc="Ensure that experimental features are not implemented in production (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if [ "$docker_version" -le 1903 ]; then
if docker version -f '{{.Server.Experimental}}' | grep false 2>/dev/null 1>&2; then
pass "$check_2_16"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_16"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi
else
desc_2_16="$desc_2_16 (Deprecated)"
check_2_16="$id_2_16 - $desc_2_16"
info "$desc_2_16"
local desc="$desc (Deprecated)"
local check="$id - $desc"
info "$desc"
resulttestjson "INFO"
fi
}
# 2.17
check_2_17() {
id_2_17="2.17"
desc_2_17="Ensure containers are restricted from acquiring new privileges (Scored)"
check_2_17="$id_2_17 - $desc_2_17"
starttestjson "$id_2_17" "$desc_2_17"
local id="2.17"
local desc="Ensure containers are restricted from acquiring new privileges (Scored)"
local check="$id - $desc"
starttestjson "$id" "$desc"
totalChecks=$((totalChecks + 1))
if get_docker_effective_command_line_args '--no-new-privileges' | grep "no-new-privileges" >/dev/null 2>&1; then
pass "$check_2_17"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
elif get_docker_configuration_file_args 'no-new-privileges' | grep true >/dev/null 2>&1; then
pass "$check_2_17"
pass "$check"
resulttestjson "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_2_17"
warn "$check"
resulttestjson "WARN"
currentScore=$((currentScore - 1))
fi