GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

use grep if auditctl isnt present, closes #150

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2017-01-25 10:22:08 +01:00
parent 5cd62e6138
commit ea39505778
2 changed files with 51 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -35,8 +35,9 @@ docker run -it --net host --pid host --cap-add audit_control \
Docker bench requires Docker 1.10.0 or later in order to run. Docker bench requires Docker 1.10.0 or later in order to run.
Also note that the default image and `Dockerfile` uses `FROM: alpine` which Note that when distributions doesn't contain `auditctl`, the audit tests will
doesn't contain `auditctl`, this will generate errors in section 1.8 to 1.15. check `/etc/audit/audit.rules` to see if a rule is present instead.
Distribution specific Dockerfiles that fixes this issue are available in the Distribution specific Dockerfiles that fixes this issue are available in the
[distros directory](https://github.com/docker/docker-bench-security/tree/master/distros). [distros directory](https://github.com/docker/docker-bench-security/tree/master/distros).

98
tests/1_host_configuration.sh
View file

@ -2,11 +2,11 @@
logit "" logit ""
info "1 - Host Configuration" info "1 - Host Configuration"
auditrules="/etc/audit/audit.rules"
# 1.1 # 1.1
check_1_1="1.1 - Create a separate partition for containers" check_1_1="1.1 - Create a separate partition for containers"
grep /var/lib/docker /etc/fstab >/dev/null 2>&1 if grep /var/lib/docker /etc/fstab >/dev/null 2>&1; then
if [ $? -eq 0 ]; then
pass "$check_1_1" pass "$check_1_1"
else else
warn "$check_1_1" warn "$check_1_1"
@ -44,32 +44,32 @@ done
# 1.5 # 1.5
check_1_5="1.5 - Audit docker daemon - /usr/bin/docker" check_1_5="1.5 - Audit docker daemon - /usr/bin/docker"
file="/usr/bin/docker " file="/usr/bin/docker "
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep "$file" >/dev/null 2>&1; then
auditctl -l | grep "$file" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_5" pass "$check_1_5"
else else
warn "$check_1_5" warn "$check_1_5"
fi fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_5"
else else
warn "1.5 - Failed to inspect: auditctl command not found." warn "$check_1_5"
fi fi
# 1.6 # 1.6
check_1_6="1.6 - Audit Docker files and directories - /var/lib/docker" check_1_6="1.6 - Audit Docker files and directories - /var/lib/docker"
directory="/var/lib/docker" directory="/var/lib/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep $directory >/dev/null 2>&1; then
auditctl -l | grep $directory >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_6" pass "$check_1_6"
else else
warn "$check_1_6" warn "$check_1_6"
fi fi
elif grep "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_6"
else else
warn "1.6 - Failed to inspect: auditctl command not found." warn "$check_1_6"
fi fi
else else
info "$check_1_6" info "$check_1_6"
@ -80,16 +80,16 @@ fi
check_1_7="1.7 - Audit Docker files and directories - /etc/docker" check_1_7="1.7 - Audit Docker files and directories - /etc/docker"
directory="/etc/docker" directory="/etc/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep $directory >/dev/null 2>&1; then
auditctl -l | grep $directory >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_7" pass "$check_1_7"
else else
warn "$check_1_7" warn "$check_1_7"
fi fi
elif grep "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_7"
else else
warn "1.7 - Failed to inspect: auditctl command not found." warn "$check_1_7"
fi fi
else else
info "$check_1_7" info "$check_1_7"
@ -100,16 +100,16 @@ fi
check_1_8="1.8 - Audit Docker files and directories - docker.service" check_1_8="1.8 - Audit Docker files and directories - docker.service"
file="$(get_systemd_service_file docker.service)" file="$(get_systemd_service_file docker.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep "$file" >/dev/null 2>&1; then
auditctl -l | grep "$file" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_8" pass "$check_1_8"
else else
warn "$check_1_8" warn "$check_1_8"
fi fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_8"
else else
warn "1.8 - Failed to inspect: auditctl command not found." warn "$check_1_8"
fi fi
else else
info "$check_1_8" info "$check_1_8"
@ -120,16 +120,16 @@ fi
check_1_9="1.9 - Audit Docker files and directories - docker.socket" check_1_9="1.9 - Audit Docker files and directories - docker.socket"
file="$(get_systemd_service_file docker.socket)" file="$(get_systemd_service_file docker.socket)"
if [ -e "$file" ]; then if [ -e "$file" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep "$file" >/dev/null 2>&1; then
auditctl -l | grep "$file" >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_9" pass "$check_1_9"
else else
warn "$check_1_9" warn "$check_1_9"
fi fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_9"
else else
warn "1.9 - Failed to inspect: auditctl command not found." warn "$check_1_9"
fi fi
else else
info "$check_1_9" info "$check_1_9"
@ -140,16 +140,16 @@ fi
check_1_10="1.10 - Audit Docker files and directories - /etc/default/docker" check_1_10="1.10 - Audit Docker files and directories - /etc/default/docker"
file="/etc/default/docker" file="/etc/default/docker"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep $file >/dev/null 2>&1; then
auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_10" pass "$check_1_10"
else else
warn "$check_1_10" warn "$check_1_10"
fi fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_10"
else else
warn "1.10 - Failed to inspect: auditctl command not found." warn "$check_1_10"
fi fi
else else
info "$check_1_10" info "$check_1_10"
@ -160,16 +160,16 @@ fi
check_1_11="1.11 - Audit Docker files and directories - /etc/docker/daemon.json" check_1_11="1.11 - Audit Docker files and directories - /etc/docker/daemon.json"
file="/etc/docker/daemon.json" file="/etc/docker/daemon.json"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep $file >/dev/null 2>&1; then
auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_11" pass "$check_1_11"
else else
warn "$check_1_11" warn "$check_1_11"
fi fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_11"
else else
warn "1.11 - Failed to inspect: auditctl command not found." warn "$check_1_11"
fi fi
else else
info "$check_1_11" info "$check_1_11"
@ -180,16 +180,16 @@ fi
check_1_12="1.12 - Audit Docker files and directories - /usr/bin/docker-containerd" check_1_12="1.12 - Audit Docker files and directories - /usr/bin/docker-containerd"
file="/usr/bin/docker-containerd" file="/usr/bin/docker-containerd"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep $file >/dev/null 2>&1; then
auditctl -l | grep $file >/dev/null 2>&1
if [ $? -eq 0 ]; then
pass "$check_1_12" pass "$check_1_12"
else else
warn "$check_1_12" warn "$check_1_12"
fi fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_12"
else else
warn "1.12 - Failed to inspect: auditctl command not found." warn "$check_1_12"
fi fi
else else
info "$check_1_12" info "$check_1_12"
@ -200,17 +200,17 @@ fi
check_1_13="1.13 - Audit Docker files and directories - /usr/bin/docker-runc" check_1_13="1.13 - Audit Docker files and directories - /usr/bin/docker-runc"
file="/usr/bin/docker-runc" file="/usr/bin/docker-runc"
if [ -f "$file" ]; then if [ -f "$file" ]; then
command -v auditctl >/dev/null 2>&1 if command -v auditctl >/dev/null 2>&1; then
if [ $? -eq 0 ]; then if auditctl -l | grep $file >/dev/null 2>&1; then
auditctl -l | grep $file >/dev/null 2>&1 pass "$check_1_13"
if [ $? -eq 0 ]; then else
warn "$check_1_13"
fi
elif grep "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_13" pass "$check_1_13"
else else
warn "$check_1_13" warn "$check_1_13"
fi fi
else
warn "1.13 - Failed to inspect: auditctl command not found."
fi
else else
info "$check_1_13" info "$check_1_13"
info " * File not found" info " * File not found"