GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2024-11-01 08:31:44 +01:00
Code Issues Projects Releases Packages Wiki Activity

Add checks for capabilities that allows container escape

Browse source
This commit is contained in:
Nikita Stupin 2021-07-08 13:10:12 +03:00
parent 2024e16f09
commit cf93e9ed07
2 changed files with 148 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
functions/functions_lib.sh
View file

@ -278,6 +278,10 @@ community_checks() {
check_c_1
check_c_1_1
check_c_2
check_c_5_3_1
check_c_5_3_2
check_c_5_3_3
check_c_5_3_4
check_c_end
}

144
tests/99_community_checks.sh
View file

@ -85,6 +85,150 @@ check_c_2() {
logcheckresult "INFO"
}
check_c_5_3_1() {
local id="C.5.3.1"
local desc="Ensure that CAP_DAC_READ_SEARCH Linux kernel capability is disabled (Automated)"
local remediation="Please refer to https://github.com/cdk-team/CDK/wiki/Exploit:-cap-dac-read-search for PoC."
local remediationImpact=""
local check="$id - $desc"
starttestjson "$id" "$desc"
fail=0
caps_containers=""
for c in $containers; do
container_caps=$(docker inspect --format 'CapAdd={{ .HostConfig.CapAdd }}' "$c")
caps=$(echo "$container_caps" | tr "[:lower:]" "[:upper:]" | \
sed 's/CAPADD/CapAdd/')
if echo "$caps" | grep -q "DAC_READ_SEARCH"; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn -s "$check"
warn " * CAP_DAC_READ_SEARCH added to $c"
caps_containers="$caps_containers $c"
fail=1
continue
fi
warn " * CAP_DAC_READ_SEARCH added to $c"
caps_containers="$caps_containers $c"
fi
done
# We went through all the containers and found none with extra capabilities
if [ $fail -eq 0 ]; then
pass -s "$check"
logcheckresult "PASS"
return
fi
logcheckresult "WARN" "CAP_DAC_READ_SEARCH capability added for containers" "$caps_containers"
}
check_c_5_3_2() {
local id="C.5.3.2"
local desc="Ensure that CAP_SYS_MODULE Linux kernel capability is disabled (Automated)"
local remediation="Please refer to https://xcellerator.github.io/posts/docker_escape/ for PoC."
local remediationImpact=""
local check="$id - $desc"
starttestjson "$id" "$desc"
fail=0
caps_containers=""
for c in $containers; do
container_caps=$(docker inspect --format 'CapAdd={{ .HostConfig.CapAdd }}' "$c")
caps=$(echo "$container_caps" | tr "[:lower:]" "[:upper:]" | \
sed 's/CAPADD/CapAdd/')
if echo "$caps" | grep -q "SYS_MODULE"; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn -s "$check"
warn " * CAP_SYS_MODULE added to $c"
caps_containers="$caps_containers $c"
fail=1
continue
fi
warn " * CAP_SYS_MODULE added to $c"
caps_containers="$caps_containers $c"
fi
done
# We went through all the containers and found none with extra capabilities
if [ $fail -eq 0 ]; then
pass -s "$check"
logcheckresult "PASS"
return
fi
logcheckresult "WARN" "CAP_SYS_MODULE capability added for containers" "$caps_containers"
}
check_c_5_3_3() {
local id="C.5.3.3"
local desc="Ensure that CAP_SYS_ADMIN Linux kernel capability is disabled (Automated)"
local remediation="Please refer to https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/ for PoC."
local remediationImpact=""
local check="$id - $desc"
starttestjson "$id" "$desc"
fail=0
caps_containers=""
for c in $containers; do
container_caps=$(docker inspect --format 'CapAdd={{ .HostConfig.CapAdd }}' "$c")
caps=$(echo "$container_caps" | tr "[:lower:]" "[:upper:]" | \
sed 's/CAPADD/CapAdd/')
if echo "$caps" | grep -q "SYS_ADMIN"; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn -s "$check"
warn " * CAP_SYS_ADMIN added to $c"
caps_containers="$caps_containers $c"
fail=1
continue
fi
warn " * CAP_SYS_ADMIN added to $c"
caps_containers="$caps_containers $c"
fi
done
# We went through all the containers and found none with extra capabilities
if [ $fail -eq 0 ]; then
pass -s "$check"
logcheckresult "PASS"
return
fi
logcheckresult "WARN" "CAP_SYS_ADMIN capability added for containers" "$caps_containers"
}
check_c_5_3_4() {
local id="C.5.3.4"
local desc="Ensure that CAP_SYS_PTRACE Linux kernel capability is disabled (Automated)"
local remediation="Please refer to https://0xn3va.gitbook.io/cheat-sheets/container/escaping/excessive-capabilities#cap_sys_ptrace"
local remediationImpact=""
local check="$id - $desc"
starttestjson "$id" "$desc"
fail=0
caps_containers=""
for c in $containers; do
container_caps=$(docker inspect --format 'CapAdd={{ .HostConfig.CapAdd }}' "$c")
caps=$(echo "$container_caps" | tr "[:lower:]" "[:upper:]" | \
sed 's/CAPADD/CapAdd/')
if echo "$caps" | grep -q "SYS_PTRACE"; then
# If it's the first container, fail the test
if [ $fail -eq 0 ]; then
warn -s "$check"
warn " * CAP_SYS_PTRACE added to $c"
caps_containers="$caps_containers $c"
fail=1
continue
fi
warn " * CAP_SYS_PTRACE added to $c"
caps_containers="$caps_containers $c"
fi
done
# We went through all the containers and found none with extra capabilities
if [ $fail -eq 0 ]; then
pass -s "$check"
logcheckresult "PASS"
return
fi
logcheckresult "WARN" "CAP_SYS_PTRACE capability added for containers" "$caps_containers"
}
check_c_end() {
endsectionjson
}