GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

Created a much more sophisticated check for whether storage has really

Browse source 
been moved off the root volume

Signed-off-by: Scott McCarty <smccarty@redhat.com>
This commit is contained in:
Scott McCarty 2015-07-08 06:09:53 -04:00
parent 9429cdd79f
commit cf836c35a6
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
tests/1_1_check.sh Executable file
View file

@ -0,0 +1,19 @@
# Run tests
THINPOOLDEV=`ps -ef | grep docker | awk '/--storage-opt/ { for (x=1;x<=NF;x++) if ($x~"--storage-opt") print $(x+1) }' | grep thinpooldev | awk -F\= '{print $2}'`
ROOTVOLUME=`df -P | grep " \/$" | awk '{print $1}'`
SEPARATEPARTITION=`grep /var/lib/docker /etc/fstab`
# Verify that somebody didn't put a dummy entry in /etc/fstab and are really
# using devicemapper
if [ "$SEPARATEPARTITION" ] && [ ! "$THINPOOLDEV" ]; then
RETVAL=0
# Verify that THINPOOLDEV exists and is not the same as root volume. I am not
# completely sure you could ever do this, but figured it's a safer check
elif [ "$THINPOOLDEV" ] && [ "$THINPOOLDEV" != "$ROOTVOLUME" ]; then
RETVAL=0
else
RETVAL=1
fi
return $RETVAL

2
tests/1_host_configuration.sh
View file

@ -5,7 +5,7 @@ info "1 - Host Configuration"
# 1.1
check_1_1="1.1 - Create a separate partition for containers"
grep /var/lib/docker /etc/fstab >/dev/null 2>&1
sh 1_1_check.sh 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_1"
else