GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

add score and totalChecks to 5_

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2017-10-23 15:40:52 +02:00
parent de82250274
commit e32910172f
1 changed files with 120 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

123
tests/5_container_runtime.sh
View file

@ -12,6 +12,7 @@ else
' '
# 5.1 # 5.1
check_5_1="5.1 - Ensure AppArmor Profile is Enabled" check_5_1="5.1 - Ensure AppArmor Profile is Enabled"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -34,10 +35,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_1" pass "$check_5_1"
logjson "5.1" "PASS" logjson "5.1" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.2 # 5.2
check_5_2="5.2 - Ensure SELinux security options are set, if applicable" check_5_2="5.2 - Ensure SELinux security options are set, if applicable"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -60,10 +65,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_2" pass "$check_5_2"
logjson "5.2" "PASS" logjson "5.2" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.3 # 5.3
check_5_3="5.3 - Ensure Linux Kernel Capabilities are restricted within containers" check_5_3="5.3 - Ensure Linux Kernel Capabilities are restricted within containers"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -89,10 +98,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_3" pass "$check_5_3"
logjson "5.3" "PASS" logjson "5.3" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.4 # 5.4
check_5_4="5.4 - Ensure privileged containers are not used" check_5_4="5.4 - Ensure privileged containers are not used"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -115,10 +128,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_4" pass "$check_5_4"
logjson "5.4" "PASS" logjson "5.4" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.5 # 5.5
check_5_5="5.5 - Ensure sensitive host system directories are not mounted on containers" check_5_5="5.5 - Ensure sensitive host system directories are not mounted on containers"
totalChecks=$((totalChecks + 1))
# List of sensitive directories to test for. Script uses new-lines as a separator. # List of sensitive directories to test for. Script uses new-lines as a separator.
# Note the lack of identation. It needs it for the substring comparison. # Note the lack of identation. It needs it for the substring comparison.
@ -161,10 +178,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_5" pass "$check_5_5"
logjson "5.5" "PASS" logjson "5.5" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.6 # 5.6
check_5_6="5.6 - Ensure ssh is not run within containers" check_5_6="5.6 - Ensure ssh is not run within containers"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
printcheck=0 printcheck=0
@ -178,7 +199,7 @@ else
warn " * Container running sshd: $c" warn " * Container running sshd: $c"
logjson "5.6" "WARN: $c" logjson "5.6" "WARN: $c"
fail=1 fail=1
printcheck=1 printcheck=1
else else
warn " * Container running sshd: $c" warn " * Container running sshd: $c"
logjson "5.6" "WARN: $c" logjson "5.6" "WARN: $c"
@ -190,7 +211,7 @@ else
if [ $printcheck -eq 0 ]; then if [ $printcheck -eq 0 ]; then
warn "$check_5_6" warn "$check_5_6"
logjson "5.6" "WARN" logjson "5.6" "WARN"
printcheck=1 printcheck=1
fi fi
warn " * Docker exec fails: $c" warn " * Docker exec fails: $c"
logjson "5.6" "WARN: $c" logjson "5.6" "WARN: $c"
@ -201,10 +222,14 @@ else
# We went through all the containers and found none with sshd # We went through all the containers and found none with sshd
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_6" pass "$check_5_6"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.7 # 5.7
check_5_7="5.7 - Ensure privileged ports are not mapped within containers" check_5_7="5.7 - Ensure privileged ports are not mapped within containers"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -231,15 +256,21 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_7" pass "$check_5_7"
logjson "5.7" "PASS" logjson "5.7" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.8 # 5.8
check_5_8="5.8 - Ensure only needed ports are open on the container" check_5_8="5.8 - Ensure only needed ports are open on the container"
totalChecks=$((totalChecks + 1))
note "$check_5_8" note "$check_5_8"
logjson "5.8" "NOTE" logjson "5.8" "NOTE"
currentScore=$((currentScore + 0))
# 5.9 # 5.9
check_5_9="5.9 - Ensure the host's network namespace is not shared" check_5_9="5.9 - Ensure the host's network namespace is not shared"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -262,10 +293,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_9" pass "$check_5_9"
logjson "5.9" "PASS" logjson "5.9" "PASS"
currentScore=$((currentScore + 0))
else
currentScore=$((currentScore - 1))
fi fi
# 5.10 # 5.10
check_5_10="5.10 - Ensure memory usage for container is limited" check_5_10="5.10 - Ensure memory usage for container is limited"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -292,10 +327,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_10" pass "$check_5_10"
logjson "5.10" "PASS" logjson "5.10" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.11 # 5.11
check_5_11="5.11 - Ensure CPU priority is set appropriately on the container" check_5_11="5.11 - Ensure CPU priority is set appropriately on the container"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -322,10 +361,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_11" pass "$check_5_11"
logjson "5.11" "PASS" logjson "5.11" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.12 # 5.12
check_5_12="5.12 - Ensure the container's root filesystem is mounted as read only" check_5_12="5.12 - Ensure the container's root filesystem is mounted as read only"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -348,10 +391,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_12" pass "$check_5_12"
logjson "5.12" "PASS" logjson "5.12" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.13 # 5.13
check_5_13="5.13 - Ensure incoming container traffic is binded to a specific host interface" check_5_13="5.13 - Ensure incoming container traffic is binded to a specific host interface"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -374,10 +421,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_13" pass "$check_5_13"
logjson "5.13" "PASS" logjson "5.13" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.14 # 5.14
check_5_14="5.14 - Ensure 'on-failure' container restart policy is set to '5'" check_5_14="5.14 - Ensure 'on-failure' container restart policy is set to '5'"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -400,10 +451,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_14" pass "$check_5_14"
logjson "5.14" "PASS" logjson "5.14" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.15 # 5.15
check_5_15="5.15 - Ensure the host's process namespace is not shared" check_5_15="5.15 - Ensure the host's process namespace is not shared"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -426,10 +481,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_15" pass "$check_5_15"
logjson "5.15" "PASS" logjson "5.15" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.16 # 5.16
check_5_16="5.16 - Ensure the host's IPC namespace is not shared" check_5_16="5.16 - Ensure the host's IPC namespace is not shared"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -452,10 +511,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_16" pass "$check_5_16"
logjson "5.16" "PASS" logjson "5.16" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.17 # 5.17
check_5_17="5.17 - Ensure host devices are not directly exposed to containers" check_5_17="5.17 - Ensure host devices are not directly exposed to containers"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -478,10 +541,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_17" pass "$check_5_17"
logjson "5.17" "PASS" logjson "5.17" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore + 0))
fi fi
# 5.18 # 5.18
check_5_18="5.18 - Ensure the default ulimit is overwritten at runtime, only if needed" check_5_18="5.18 - Ensure the default ulimit is overwritten at runtime, only if needed"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -504,10 +571,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_18" pass "$check_5_18"
logjson "5.18" "PASS" logjson "5.18" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore + 0))
fi fi
# 5.19 # 5.19
check_5_19="5.19 - Ensure mount propagation mode is not set to shared" check_5_19="5.19 - Ensure mount propagation mode is not set to shared"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -526,13 +597,17 @@ else
fi fi
done done
# We went through all the containers and found none with shared propagation mode # We went through all the containers and found none with shared propagation mode
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_19" pass "$check_5_19"
logjson "5.19" "PASS" logjson "5.19" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.20 # 5.20
check_5_20="5.20 - Ensure the host's UTS namespace is not shared" check_5_20="5.20 - Ensure the host's UTS namespace is not shared"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -555,10 +630,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_20" pass "$check_5_20"
logjson "5.20" "PASS" logjson "5.20" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.21 # 5.21
check_5_21="5.21 - Ensure the default seccomp profile is not Disabled" check_5_21="5.21 - Ensure the default seccomp profile is not Disabled"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -579,20 +658,28 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_21" pass "$check_5_21"
logjson "5.21" "PASS" logjson "5.21" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.22 # 5.22
check_5_22="5.22 - Ensure docker exec commands are not used with privileged option" check_5_22="5.22 - Ensure docker exec commands are not used with privileged option"
totalChecks=$((totalChecks + 1))
note "$check_5_22" note "$check_5_22"
logjson "5.22" "NOTE" logjson "5.22" "NOTE"
currentScore=$((currentScore + 0))
# 5.23 # 5.23
check_5_23="5.23 - Ensure docker exec commands are not used with user option" check_5_23="5.23 - Ensure docker exec commands are not used with user option"
totalChecks=$((totalChecks + 1))
note "$check_5_23" note "$check_5_23"
logjson "5.23" "NOTE" logjson "5.23" "NOTE"
currentScore=$((currentScore + 0))
# 5.24 # 5.24
check_5_24="5.24 - Ensure cgroup usage is confirmed" check_5_24="5.24 - Ensure cgroup usage is confirmed"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -615,10 +702,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_24" pass "$check_5_24"
logjson "5.24" "PASS" logjson "5.24" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.25 # 5.25
check_5_25="5.25 - Ensure the container is restricted from acquiring additional privileges" check_5_25="5.25 - Ensure the container is restricted from acquiring additional privileges"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -639,10 +730,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_25" pass "$check_5_25"
logjson "5.25" "PASS" logjson "5.25" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.26 # 5.26
check_5_26="5.26 - Ensure container health is checked at runtime" check_5_26="5.26 - Ensure container health is checked at runtime"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -661,15 +756,21 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_26" pass "$check_5_26"
logjson "5.26" "PASS" logjson "5.26" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.27 # 5.27
check_5_27="5.27 - Ensure docker commands always get the latest version of the image" check_5_27="5.27 - Ensure docker commands always get the latest version of the image"
totalChecks=$((totalChecks + 1))
info "$check_5_27" info "$check_5_27"
logjson "5.27" "INFO" logjson "5.27" "INFO"
currentScore=$((currentScore + 0))
# 5.28 # 5.28
check_5_28="5.28 - Ensure PIDs cgroup limit is used" check_5_28="5.28 - Ensure PIDs cgroup limit is used"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -692,10 +793,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_28" pass "$check_5_28"
logjson "5.28" "PASS" logjson "5.28" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.29 # 5.29
check_5_29="5.29 - Ensure Docker's default bridge docker0 is not used" check_5_29="5.29 - Ensure Docker's default bridge docker0 is not used"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
networks=$(docker network ls -q 2>/dev/null) networks=$(docker network ls -q 2>/dev/null)
@ -715,16 +820,21 @@ else
logjson "5.29" "INFO: $c" logjson "5.29" "INFO: $c"
done done
fi fi
currentScore=$((currentScore + 0))
fi fi
done done
# We went through all the containers and found none in docker0 network # We went through all the containers and found none in docker0 network
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_29" pass "$check_5_29"
logjson "5.29" "PASS" logjson "5.29" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.30 # 5.30
check_5_30="5.30 - Ensure the host's user namespaces is not shared" check_5_30="5.30 - Ensure the host's user namespaces is not shared"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -745,10 +855,14 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_30" pass "$check_5_30"
logjson "5.30" "PASS" logjson "5.30" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
# 5.31 # 5.31
check_5_31="5.31 - Ensure the Docker socket is not mounted inside any containers" check_5_31="5.31 - Ensure the Docker socket is not mounted inside any containers"
totalChecks=$((totalChecks + 1))
fail=0 fail=0
for c in $containers; do for c in $containers; do
@ -769,5 +883,8 @@ else
if [ $fail -eq 0 ]; then if [ $fail -eq 0 ]; then
pass "$check_5_31" pass "$check_5_31"
logjson "5.31" "PASS" logjson "5.31" "PASS"
currentScore=$((currentScore + 1))
else
currentScore=$((currentScore - 1))
fi fi
fi fi