From cf7c50bf331e728b1be39a3fd0de06d0290a2513 Mon Sep 17 00:00:00 2001 From: Jo Cook Date: Tue, 23 Feb 2021 12:15:22 +0000 Subject: [PATCH 1/2] Update README.md Clarified that log files are created inside the container so that new users (ie me) don't spend ages wondering where the logs are! --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e60517f..afe1027 100644 --- a/README.md +++ b/README.md @@ -83,7 +83,7 @@ version 1.13.0 or later. ```sh -b optional Do not print colors -h optional Print this help message - -l FILE optional Log output in FILE + -l FILE optional Log output in FILE inside docker bench container -c CHECK optional Comma delimited list of specific check(s) -e CHECK optional Comma delimited list of specific check(s) to exclude -i INCLUDE optional Comma delimited list of patterns within a container or image name to check @@ -91,7 +91,7 @@ version 1.13.0 or later. ``` By default the Docker Bench for Security script will run all available CIS tests -and produce logs in the current directory named `docker-bench-security.sh.log.json` +and produce logs in the current directory inside the container, named `docker-bench-security.sh.log.json` and `docker-bench-security.sh.log`. The CIS based checks are named `check_
_`, e.g. `check_2_6` and community contributed checks are named `check_c_`. From 3732a475cbc39f4a29ab3035b9302bdb8b2452cc Mon Sep 17 00:00:00 2001 From: Jo Cook Date: Tue, 23 Feb 2021 17:25:12 +0000 Subject: [PATCH 2/2] Update README.md Extended my two edits to specify that they only apply if running in a container. --- README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index afe1027..57b13ca 100644 --- a/README.md +++ b/README.md @@ -83,7 +83,7 @@ version 1.13.0 or later. ```sh -b optional Do not print colors -h optional Print this help message - -l FILE optional Log output in FILE inside docker bench container + -l FILE optional Log output in FILE, inside container if run using docker -c CHECK optional Comma delimited list of specific check(s) -e CHECK optional Comma delimited list of specific check(s) to exclude -i INCLUDE optional Comma delimited list of patterns within a container or image name to check @@ -91,8 +91,11 @@ version 1.13.0 or later. ``` By default the Docker Bench for Security script will run all available CIS tests -and produce logs in the current directory inside the container, named `docker-bench-security.sh.log.json` +and produce logs in the current directory, named `docker-bench-security.sh.log.json` and `docker-bench-security.sh.log`. + +If the docker container is used then the log files will be created inside the container. If you wish to access them from the host after the container has been run you will need to mount a volume for storing them in. + The CIS based checks are named `check_
_`, e.g. `check_2_6` and community contributed checks are named `check_c_`. A complete list of checks is present in [functions_lib.sh](functions_lib.sh).