mirror of
https://github.com/docker/docker-bench-security.git
synced 2025-01-18 16:22:33 +01:00
add score and totalChecks to 5_
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren
parent
de82250274
commit
e32910172f
1 changed files with 120 additions and 3 deletions
|
|
@ -12,6 +12,7 @@ else
|
|||
'
|
||||
# 5.1
|
||||
check_5_1="5.1 - Ensure AppArmor Profile is Enabled"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -34,10 +35,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_1"
|
||||
logjson "5.1" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.2
|
||||
check_5_2="5.2 - Ensure SELinux security options are set, if applicable"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -60,10 +65,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_2"
|
||||
logjson "5.2" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.3
|
||||
check_5_3="5.3 - Ensure Linux Kernel Capabilities are restricted within containers"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -89,10 +98,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_3"
|
||||
logjson "5.3" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.4
|
||||
check_5_4="5.4 - Ensure privileged containers are not used"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -115,10 +128,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_4"
|
||||
logjson "5.4" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.5
|
||||
check_5_5="5.5 - Ensure sensitive host system directories are not mounted on containers"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
# List of sensitive directories to test for. Script uses new-lines as a separator.
|
||||
# Note the lack of identation. It needs it for the substring comparison.
|
||||
|
|
@ -161,10 +178,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_5"
|
||||
logjson "5.5" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.6
|
||||
check_5_6="5.6 - Ensure ssh is not run within containers"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
printcheck=0
|
||||
|
|
@ -178,7 +199,7 @@ else
|
|||
warn " * Container running sshd: $c"
|
||||
logjson "5.6" "WARN: $c"
|
||||
fail=1
|
||||
printcheck=1
|
||||
printcheck=1
|
||||
else
|
||||
warn " * Container running sshd: $c"
|
||||
logjson "5.6" "WARN: $c"
|
||||
|
|
@ -190,7 +211,7 @@ else
|
|||
if [ $printcheck -eq 0 ]; then
|
||||
warn "$check_5_6"
|
||||
logjson "5.6" "WARN"
|
||||
printcheck=1
|
||||
printcheck=1
|
||||
fi
|
||||
warn " * Docker exec fails: $c"
|
||||
logjson "5.6" "WARN: $c"
|
||||
|
|
@ -201,10 +222,14 @@ else
|
|||
# We went through all the containers and found none with sshd
|
||||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_6"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.7
|
||||
check_5_7="5.7 - Ensure privileged ports are not mapped within containers"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -231,15 +256,21 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_7"
|
||||
logjson "5.7" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.8
|
||||
check_5_8="5.8 - Ensure only needed ports are open on the container"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
note "$check_5_8"
|
||||
logjson "5.8" "NOTE"
|
||||
currentScore=$((currentScore + 0))
|
||||
|
||||
# 5.9
|
||||
check_5_9="5.9 - Ensure the host's network namespace is not shared"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -262,10 +293,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_9"
|
||||
logjson "5.9" "PASS"
|
||||
currentScore=$((currentScore + 0))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.10
|
||||
check_5_10="5.10 - Ensure memory usage for container is limited"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -292,10 +327,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_10"
|
||||
logjson "5.10" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.11
|
||||
check_5_11="5.11 - Ensure CPU priority is set appropriately on the container"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -322,10 +361,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_11"
|
||||
logjson "5.11" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.12
|
||||
check_5_12="5.12 - Ensure the container's root filesystem is mounted as read only"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -348,10 +391,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_12"
|
||||
logjson "5.12" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.13
|
||||
check_5_13="5.13 - Ensure incoming container traffic is binded to a specific host interface"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -374,10 +421,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_13"
|
||||
logjson "5.13" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.14
|
||||
check_5_14="5.14 - Ensure 'on-failure' container restart policy is set to '5'"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -400,10 +451,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_14"
|
||||
logjson "5.14" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.15
|
||||
check_5_15="5.15 - Ensure the host's process namespace is not shared"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -426,10 +481,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_15"
|
||||
logjson "5.15" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.16
|
||||
check_5_16="5.16 - Ensure the host's IPC namespace is not shared"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -452,10 +511,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_16"
|
||||
logjson "5.16" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.17
|
||||
check_5_17="5.17 - Ensure host devices are not directly exposed to containers"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -478,10 +541,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_17"
|
||||
logjson "5.17" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
|
||||
# 5.18
|
||||
check_5_18="5.18 - Ensure the default ulimit is overwritten at runtime, only if needed"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -504,10 +571,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_18"
|
||||
logjson "5.18" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
|
||||
# 5.19
|
||||
check_5_19="5.19 - Ensure mount propagation mode is not set to shared"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -526,13 +597,17 @@ else
|
|||
fi
|
||||
done
|
||||
# We went through all the containers and found none with shared propagation mode
|
||||
if [ $fail -eq 0 ]; then
|
||||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_19"
|
||||
logjson "5.19" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.20
|
||||
check_5_20="5.20 - Ensure the host's UTS namespace is not shared"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -555,10 +630,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_20"
|
||||
logjson "5.20" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.21
|
||||
check_5_21="5.21 - Ensure the default seccomp profile is not Disabled"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -579,20 +658,28 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_21"
|
||||
logjson "5.21" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.22
|
||||
check_5_22="5.22 - Ensure docker exec commands are not used with privileged option"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
note "$check_5_22"
|
||||
logjson "5.22" "NOTE"
|
||||
currentScore=$((currentScore + 0))
|
||||
|
||||
# 5.23
|
||||
check_5_23="5.23 - Ensure docker exec commands are not used with user option"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
note "$check_5_23"
|
||||
logjson "5.23" "NOTE"
|
||||
currentScore=$((currentScore + 0))
|
||||
|
||||
# 5.24
|
||||
check_5_24="5.24 - Ensure cgroup usage is confirmed"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -615,10 +702,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_24"
|
||||
logjson "5.24" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.25
|
||||
check_5_25="5.25 - Ensure the container is restricted from acquiring additional privileges"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -639,10 +730,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_25"
|
||||
logjson "5.25" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.26
|
||||
check_5_26="5.26 - Ensure container health is checked at runtime"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -661,15 +756,21 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_26"
|
||||
logjson "5.26" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.27
|
||||
check_5_27="5.27 - Ensure docker commands always get the latest version of the image"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
info "$check_5_27"
|
||||
logjson "5.27" "INFO"
|
||||
currentScore=$((currentScore + 0))
|
||||
|
||||
# 5.28
|
||||
check_5_28="5.28 - Ensure PIDs cgroup limit is used"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -692,10 +793,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_28"
|
||||
logjson "5.28" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.29
|
||||
check_5_29="5.29 - Ensure Docker's default bridge docker0 is not used"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
networks=$(docker network ls -q 2>/dev/null)
|
||||
|
|
@ -715,16 +820,21 @@ else
|
|||
logjson "5.29" "INFO: $c"
|
||||
done
|
||||
fi
|
||||
currentScore=$((currentScore + 0))
|
||||
fi
|
||||
done
|
||||
# We went through all the containers and found none in docker0 network
|
||||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_29"
|
||||
logjson "5.29" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.30
|
||||
check_5_30="5.30 - Ensure the host's user namespaces is not shared"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -745,10 +855,14 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_30"
|
||||
logjson "5.30" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
|
||||
# 5.31
|
||||
check_5_31="5.31 - Ensure the Docker socket is not mounted inside any containers"
|
||||
totalChecks=$((totalChecks + 1))
|
||||
|
||||
fail=0
|
||||
for c in $containers; do
|
||||
|
|
@ -769,5 +883,8 @@ else
|
|||
if [ $fail -eq 0 ]; then
|
||||
pass "$check_5_31"
|
||||
logjson "5.31" "PASS"
|
||||
currentScore=$((currentScore + 1))
|
||||
else
|
||||
currentScore=$((currentScore - 1))
|
||||
fi
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue