GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-09-22 16:47:14 +00:00
Code Issues Projects Releases Packages Wiki Activity

Improve docker-bench-security json output

Browse source 
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.

Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.

Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.

All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm 2018-07-11 18:02:12 -07:00
commit ec7d8ce690
11 changed files with 1006 additions and 427 deletions

30
tests/6_docker_security_operations.sh
View file

@ -2,12 +2,20 @@
check_6() {
logit "\n"
info "6 - Docker Security Operations"
id_6="6"
desc_6="Docker Security Operations"
check_6="$id_6 - $desc_6"
info "$check_6"
startsectionjson "$id_6" "$desc_6"
}
# 6.1
check_6_1() {
check_6_1="6.1 - Avoid image sprawl"
id_6_1="6.1"
desc_6_1="Avoid image sprawl"
check_6_1="$id_6_1 - $desc_6_1"
starttestjson "$id_6_1" "$desc_6_1"
totalChecks=$((totalChecks + 1))
images=$(docker images -q | sort -u | wc -l | awk '{print $1}')
active_images=0
@ -23,26 +31,34 @@ check_6_1() {
if [ "$active_images" -lt "$((images / 2))" ]; then
info " * Only $active_images out of $images are in use"
logjson "6.1" "INFO: $active_images"
fi
resulttestjson "INFO" "$active_images active/$images in use"
currentScore=$((currentScore + 0))
}
# 6.2
check_6_2() {
check_6_2="6.2 - Avoid container sprawl"
id_6_2="6.2"
desc_6_2="Avoid container sprawl"
check_6_2="$id_6_2 - $desc_6_2"
starttestjson "$id_6_2" "$desc_6_2"
totalChecks=$((totalChecks + 1))
total_containers=$(docker info 2>/dev/null | grep "^Containers" | awk '{print $2}')
total_containers=$(docker info 2>/dev/null | grep "Containers" | awk '{print $2}')
running_containers=$(docker ps -q | wc -l | awk '{print $1}')
diff="$((total_containers - running_containers))"
if [ "$diff" -gt 25 ]; then
info "$check_6_2"
info " * There are currently a total of $total_containers containers, with only $running_containers of them currently running"
logjson "6.2" "INFO: $running_containers"
resulttestjson "INFO" "$total_containers total/$running_containers running"
else
info "$check_6_2"
info " * There are currently a total of $total_containers containers, with $running_containers of them currently running"
logjson "6.2" "INFO: $running_containers"
resulttestjson "INFO" "$total_containers total/$running_containers running"
fi
currentScore=$((currentScore + 0))
}
check_6_end() {
endsectionjson
}