mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-05-17 15:05:31 +00:00
Bug fixing and improving source code readability
This commit is contained in:
Razvan Stoica
parent
86985f854f
commit
d0443cc817
12 changed files with 1028 additions and 783 deletions
|
|
@ -6,6 +6,23 @@ abspath () { case "$1" in /*)printf "%s\n" "$1";; *)printf "%s\n" "$PWD/$1";; es
|
|||
# Audit rules default path
|
||||
auditrules="/etc/audit/audit.rules"
|
||||
|
||||
# Check for required program(s)
|
||||
req_programs() {
|
||||
for p in $1; do
|
||||
command -v "$p" >/dev/null 2>&1 || { printf "Required program not found: %s\n" "$p"; exit 1; }
|
||||
done
|
||||
if command -v ss >/dev/null 2>&1; then
|
||||
netbin=ss
|
||||
return
|
||||
fi
|
||||
if command -v netstat >/dev/null 2>&1; then
|
||||
netbin=netstat
|
||||
return
|
||||
fi
|
||||
echo "ss or netstat command not found."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Compares versions of software of the format X.Y.Z
|
||||
do_version_check() {
|
||||
[ "$1" = "$2" ] && return 10
|
||||
|
|
@ -23,9 +40,8 @@ do_version_check() {
|
|||
[ "$ver2front" = "$2" ] || [ -z "$ver2back" ] && ver2back=0
|
||||
do_version_check "$ver1back" "$ver2back"
|
||||
return $?
|
||||
else
|
||||
[ "$1" -gt "$2" ] && return 11 || return 9
|
||||
fi
|
||||
[ "$1" -gt "$2" ] && return 11 || return 9
|
||||
}
|
||||
|
||||
# Extracts commandline args from the newest running processes named like the first parameter
|
||||
|
|
@ -45,10 +61,9 @@ get_command_line_args() {
|
|||
get_docker_cumulative_command_line_args() {
|
||||
OPTION="$1"
|
||||
|
||||
line_arg="dockerd"
|
||||
if ! get_command_line_args "docker daemon" >/dev/null 2>&1 ; then
|
||||
line_arg="docker daemon"
|
||||
else
|
||||
line_arg="dockerd"
|
||||
fi
|
||||
|
||||
get_command_line_args "$line_arg" |
|
||||
|
|
@ -88,11 +103,13 @@ get_docker_configuration_file() {
|
|||
|
||||
if [ -f "$FILE" ]; then
|
||||
CONFIG_FILE="$FILE"
|
||||
elif [ -f '/etc/docker/daemon.json' ]; then
|
||||
CONFIG_FILE='/etc/docker/daemon.json'
|
||||
else
|
||||
CONFIG_FILE='/dev/null'
|
||||
return
|
||||
fi
|
||||
if [ -f '/etc/docker/daemon.json' ]; then
|
||||
CONFIG_FILE='/etc/docker/daemon.json'
|
||||
return
|
||||
fi
|
||||
CONFIG_FILE='/dev/null'
|
||||
}
|
||||
|
||||
get_docker_configuration_file_args() {
|
||||
|
|
@ -108,13 +125,17 @@ get_service_file() {
|
|||
|
||||
if [ -f "/etc/systemd/system/$SERVICE" ]; then
|
||||
echo "/etc/systemd/system/$SERVICE"
|
||||
elif [ -f "/lib/systemd/system/$SERVICE" ]; then
|
||||
echo "/lib/systemd/system/$SERVICE"
|
||||
elif systemctl show -p FragmentPath "$SERVICE" 2> /dev/null 1>&2; then
|
||||
systemctl show -p FragmentPath "$SERVICE" | sed 's/.*=//'
|
||||
else
|
||||
echo "/usr/lib/systemd/system/$SERVICE"
|
||||
return
|
||||
fi
|
||||
if [ -f "/lib/systemd/system/$SERVICE" ]; then
|
||||
echo "/lib/systemd/system/$SERVICE"
|
||||
return
|
||||
fi
|
||||
if systemctl show -p FragmentPath "$SERVICE" 2> /dev/null 1>&2; then
|
||||
systemctl show -p FragmentPath "$SERVICE" | sed 's/.*=//'
|
||||
return
|
||||
fi
|
||||
echo "/usr/lib/systemd/system/$SERVICE"
|
||||
}
|
||||
|
||||
yell_info() {
|
||||
|
|
|
|||
|
|
@ -87,8 +87,8 @@ note () {
|
|||
if [ "$noteCountCheck" = "true" ]; then
|
||||
printf "%b\n" "${bldylw}[NOTE]${txtrst} $2" | tee -a "$logger"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
return
|
||||
fi
|
||||
return
|
||||
fi
|
||||
printf "%b\n" "${bldylw}[NOTE]${txtrst} $1" | tee -a "$logger"
|
||||
}
|
||||
|
||||
|
|
@ -125,37 +125,38 @@ starttestjson() {
|
|||
SEP=","
|
||||
}
|
||||
|
||||
log_to_json() {
|
||||
if [ $# -eq 1 ]; then
|
||||
printf "\"result\": \"%s\"" "$1" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
return
|
||||
fi
|
||||
if [ $# -eq 2 ] && [ $# -ne 1 ]; then
|
||||
# Result also contains details
|
||||
printf "\"result\": \"%s\",\n \"details\": \"%s\"" "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
return
|
||||
fi
|
||||
# Result also includes details and a list of items. Add that directly to details and to an array property "items"
|
||||
# Also limit the number of items to $limit, if $limit is non-zero
|
||||
truncItems=$3
|
||||
if [ $limit != 0 ]; then
|
||||
truncItems=""
|
||||
ITEM_COUNT=0
|
||||
for item in $3; do
|
||||
truncItems="$truncItems $item"
|
||||
ITEM_COUNT=$((ITEM_COUNT + 1));
|
||||
if [ "$ITEM_COUNT" == "$limit" ]; then
|
||||
truncItems="$truncItems (truncated)"
|
||||
break;
|
||||
fi
|
||||
done
|
||||
fi
|
||||
itemsJson=$(printf "[\n "; ISEP=""; ITEMCOUNT=0; for item in $truncItems; do printf "%s\"%s\"" "$ISEP" "$item"; ISEP=","; done; printf "\n ]")
|
||||
printf "\"result\": \"%s\",\n \"details\": \"%s: %s\",\n \"items\": %s" "$1" "$2" "$truncItems" "$itemsJson" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
}
|
||||
|
||||
logcheckresult() {
|
||||
# Log to JSON
|
||||
if [ $# -eq 1 ]; then
|
||||
printf "\"result\": \"%s\"" "$1" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
|
||||
if [ $# -eq 2 ] && [ $# -ne 1 ]; then
|
||||
# Result also contains details
|
||||
printf "\"result\": \"%s\",\n \"details\": \"%s\"" "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
|
||||
if [ $# -ne 2 ] && [ $# -ne 1 ]; then
|
||||
# Result also includes details and a list of items. Add that directly to details and to an array property "items"
|
||||
# Also limit the number of items to $limit, if $limit is non-zero
|
||||
if [ $limit != 0 ]; then
|
||||
truncItems=""
|
||||
ITEM_COUNT=0
|
||||
for item in $3; do
|
||||
truncItems="$truncItems $item"
|
||||
ITEM_COUNT=$((ITEM_COUNT + 1));
|
||||
if [ "$ITEM_COUNT" == "$limit" ]; then
|
||||
truncItems="$truncItems (truncated)"
|
||||
break;
|
||||
fi
|
||||
done
|
||||
else
|
||||
truncItems=$3
|
||||
fi
|
||||
itemsJson=$(printf "[\n "; ISEP=""; ITEMCOUNT=0; for item in $truncItems; do printf "%s\"%s\"" "$ISEP" "$item"; ISEP=","; done; printf "\n ]")
|
||||
printf "\"result\": \"%s\",\n \"details\": \"%s: %s\",\n \"items\": %s" "$1" "$2" "$truncItems" "$itemsJson" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
log_to_json "$@"
|
||||
|
||||
# Log remediation measure to JSON
|
||||
if [ -n "$remediation" ] && [ "$1" != "PASS" ] && [ "$printremediation" = "1" ]; then
|
||||
|
|
|
|||
194
functions/output_lib.sh.save
Normal file
194
functions/output_lib.sh.save
Normal file
|
|
@ -0,0 +1,194 @@
|
|||
#!/bin/sh
|
||||
|
||||
bldred='\033[1;31m' # Bold Red
|
||||
bldgrn='\033[1;32m' # Bold Green
|
||||
bldblu='\033[1;34m' # Bold Blue
|
||||
bldylw='\033[1;33m' # Bold Yellow
|
||||
txtrst='\033[0m'
|
||||
|
||||
if [ -n "$nocolor"
|
||||
] && [ "$nocolor" = "nocolor" ]; then
|
||||
bldred=''
|
||||
bldgrn=''
|
||||
bldblu=''
|
||||
bldylw=''
|
||||
txtrst=''
|
||||
fi
|
||||
|
||||
logit () {
|
||||
printf "%b\n" "$1" | tee -a "$logger"
|
||||
}
|
||||
|
||||
info () {
|
||||
local infoCountCheck
|
||||
while getopts c args
|
||||
do
|
||||
case $args in
|
||||
c) infoCountCheck="true" ;;
|
||||
*) exit 1 ;;
|
||||
esac
|
||||
done
|
||||
if [ "$infoCountCheck" = "true" ]; then
|
||||
printf "%b\n" "${bldblu}[INFO]${txtrst} $2" | tee -a "$logger"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
return
|
||||
fi
|
||||
printf "%b\n" "${bldblu}[INFO]${txtrst} $1" | tee -a "$logger"
|
||||
}
|
||||
|
||||
pass () {
|
||||
local passScored
|
||||
while getopts sc args
|
||||
do
|
||||
case $args in
|
||||
s) passScored="true" ;;
|
||||
c) passCountCheck="true" ;;
|
||||
*) exit 1 ;;
|
||||
esac
|
||||
done
|
||||
if [ "$passScored" = "true" ] || [ "$passCountCheck" = "true" ]; then
|
||||
printf "%b\n" "${bldgrn}[PASS]${txtrst} $2" | tee -a "$logger"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
fi
|
||||
if [ "$passScored" = "true" ]; then
|
||||
currentScore=$((currentScore + 1))
|
||||
fi
|
||||
if [ "$passScored" != "true" ] && [ "$passCountCheck" != "true" ]; then
|
||||
printf "%b\n" "${bldgrn}[PASS]${txtrst} $1" | tee -a "$logger"
|
||||
fi
|
||||
}
|
||||
|
||||
warn () {
|
||||
local warnScored
|
||||
while getopts s args
|
||||
do
|
||||
case $args in
|
||||
s) warnScored="true" ;;
|
||||
*) exit 1 ;;
|
||||
esac
|
||||
done
|
||||
if [ "$warnScored" = "true" ]; then
|
||||
printf "%b\n" "${bldred}[WARN]${txtrst} $2" | tee -a "$logger"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
currentScore=$((currentScore - 1))
|
||||
return
|
||||
fi
|
||||
printf "%b\n" "${bldred}[WARN]${txtrst} $1" | tee -a "$logger"
|
||||
}
|
||||
|
||||
note () {
|
||||
local noteCountCheck
|
||||
while getopts c args
|
||||
do
|
||||
case $args in
|
||||
c) noteCountCheck="true" ;;
|
||||
*) exit 1 ;;
|
||||
esac
|
||||
done
|
||||
if [ "$noteCountCheck" = "true" ]; then
|
||||
printf "%b\n" "${bldylw}[NOTE]${txtrst} $2" | tee -a "$logger"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
return
|
||||
fi
|
||||
printf "%b\n" "${bldylw}[NOTE]${txtrst} $1" | tee -a "$logger"
|
||||
}
|
||||
|
||||
yell () {
|
||||
printf "%b\n" "${bldylw}$1${txtrst}\n"
|
||||
}
|
||||
|
||||
appendjson () {
|
||||
if [ -s "$logger.json" ]; then
|
||||
tail -n 1 "$logger.json" | wc -c | xargs -I {} truncate "$logger.json" -s -{}
|
||||
printf "},\n" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
return
|
||||
fi
|
||||
printf "[" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
}
|
||||
|
||||
beginjson () {
|
||||
printf "{\n \"dockerbenchsecurity\": \"%s\",\n \"start\": %s,\n \"tests\": [" "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
}
|
||||
|
||||
endjson (){
|
||||
printf "\n ], \"checks\": %s, \"score\": %s, \"end\": %s\n}]" "$1" "$2" "$3" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
}
|
||||
|
||||
logjson (){
|
||||
printf "\n \"%s\": \"%s\"," "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
}
|
||||
|
||||
SSEP=
|
||||
SEP=
|
||||
startsectionjson() {
|
||||
printf "%s\n {\"id\": \"%s\", \"desc\": \"%s\", \"results\": [" "$SSEP" "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
SEP=
|
||||
SSEP=","
|
||||
}
|
||||
|
||||
endsectionjson() {
|
||||
printf "\n ]}" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
}
|
||||
|
||||
starttestjson() {
|
||||
printf "%s\n {\"id\": \"%s\", \"desc\": \"%s\", " "$SEP" "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
SEP=","
|
||||
}
|
||||
|
||||
logcheckresult() {
|
||||
# Log to JSON
|
||||
if [ $# -eq 1 ]; then
|
||||
printf "\"result\": \"%s\"" "$1" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
|
||||
if [ $# -eq 2 ] && [ $# -ne 1 ]; then
|
||||
# Result also contains details
|
||||
printf "\"result\": \"%s\", \"details\": \"%s\"" "$1" "$2" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
|
||||
if [ $# -ne 2 ] && [ $# -ne 1 ]; then
|
||||
# Result also includes details and a list of items. Add that directly to details and to an array property "items"
|
||||
# Also limit the number of items to $limit, if $limit is non-zero
|
||||
if [ $limit != 0 ]; then
|
||||
truncItems=""
|
||||
ITEM_COUNT=0
|
||||
for item in $3; do
|
||||
truncItems="$truncItems $item"
|
||||
ITEM_COUNT=$((ITEM_COUNT + 1));
|
||||
if [ "$ITEM_COUNT" == "$limit" ]; then
|
||||
truncItems="$truncItems (truncated)"
|
||||
break;
|
||||
fi
|
||||
done
|
||||
else
|
||||
truncItems=$3
|
||||
fi
|
||||
itemsJson=$(printf "["; ISEP=""; ITEMCOUNT=0; for item in $truncItems; do printf "%s\"%s\"" "$ISEP" "$item"; ISEP=","; done; printf "]")
|
||||
printf "\"result\": \"%s\", \"details\": \"%s: %s\", \"items\": %s" "$1" "$2" "$truncItems" "$itemsJson" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
|
||||
# Log remediation measure to JSON
|
||||
if [ -n "$remediation" ] && [ "$1" != "PASS" ] && [ "$printremediation" = "1" ]; then
|
||||
printf ", \"remediation\": \"%s\"" "$remediation" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
if [ -n "$remediationImpact" ]; then
|
||||
printf ", \"remediation-impact\": \"%s\"" "$remediationImpact" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
fi
|
||||
fi
|
||||
printf "}" | tee -a "$logger.json" 2>/dev/null 1>&2
|
||||
|
||||
# Save remediation measure for print log to stdout
|
||||
if [ -n "$remediation" ] && [ "$1" != "PASS" ]; then
|
||||
if [ -n "${checkHeader}" ]; then
|
||||
if [ -n "${addSpaceHeader}" ]; then
|
||||
globalRemediation="${globalRemediation}\n"
|
||||
fi
|
||||
globalRemediation="${globalRemediation}\n${bldblu}[INFO]${txtrst} ${checkHeader}"
|
||||
checkHeader=""
|
||||
addSpaceHeader="1"
|
||||
fi
|
||||
globalRemediation="${globalRemediation}\n${bldblu}[INFO]${txtrst} ${id} - ${remediation}"
|
||||
if [ -n "${remediationImpact}" ]; then
|
||||
globalRemediation="${globalRemediation} Impact: ${remediationImpact}"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue