From 3b6a0d1a6e155969392e7e4a0e36be6e6f57065e Mon Sep 17 00:00:00 2001 From: Andreas Stieger Date: Tue, 17 Nov 2015 14:56:34 +0100 Subject: [PATCH 1/4] Documentation fix for get_command_line_args pgrep is run with -o, returning only the oldest process, usually the daemon. Adjust function comment. TODO: read from PID file Signed-off-by: Andreas Stieger --- helper_lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helper_lib.sh b/helper_lib.sh index 7577816..2c39b6b 100644 --- a/helper_lib.sh +++ b/helper_lib.sh @@ -37,7 +37,7 @@ contains() { fi } -# Extracts all commandline args from all running processes named like the first parameter +# Extracts all commandline args from the oldest running processes named like the first parameter get_command_line_args() { PROC="$1" From ef81ec7a47979cce056dae5ab795ee2450f2faab Mon Sep 17 00:00:00 2001 From: Andreas Stieger Date: Tue, 17 Nov 2015 15:42:01 +0100 Subject: [PATCH 2/4] Add helper functions in preparation of fixing #97, #98, #99 get_docker_cumulative_command_line_args: new get_docker_effective_command_line_args: new Signed-off-by: Andreas Stieger --- helper_lib.sh | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/helper_lib.sh b/helper_lib.sh index 2c39b6b..0e8c296 100644 --- a/helper_lib.sh +++ b/helper_lib.sh @@ -46,3 +46,38 @@ get_command_line_args() { tr "\0" " " < /proc/"$PID"/cmdline done } + +# Extract the cumulative command line arguments for the docker daemon +# +# If specified multiple times, all matches are returned. +# Accounts for long and short variants, call with short option. +# Does not account for option defaults or implicit options. +get_docker_cumulative_command_line_args() { + OPTION="$1" + + get_command_line_args docker | + # normalize known long options to their short versions + sed \ + -e 's/\-\-debug/-D/g' \ + -e 's/\-\-host/-H/g' \ + -e 's/\-\-log-level/-l/g' \ + -e 's/\-\-version/-v/g' \ + | + # normalize parameters separated by space(s) to -O=VALUE + sed \ + -e 's/\-\([DHlv]\)[= ]\([^- ][^ ]\)/-\1=\2/g' \ + | + # get the last interesting option + tr ' ' "\n" | + grep "^${OPTION}" +} + +# Extract the effective command line arguments for the docker daemon +# +# Accounts for multiple specifications, takes the last option. +# Accounts for long and short variants, call with short option +# Does not account for option default or implicit options. +get_docker_effective_command_line_args() { + OPTION="$1" + get_docker_cumulative_command_line_args $OPTION | tail -n1 +} From 49f78d715ad2bd5635301e99e8dce67f8bbd38c1 Mon Sep 17 00:00:00 2001 From: Andreas Stieger Date: Tue, 17 Nov 2015 16:04:58 +0100 Subject: [PATCH 3/4] In preparation to fixing #99, normalize different methods of quoting to no quoting Signed-off-by: Andreas Stieger --- helper_lib.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/helper_lib.sh b/helper_lib.sh index 0e8c296..7704f4d 100644 --- a/helper_lib.sh +++ b/helper_lib.sh @@ -69,7 +69,11 @@ get_docker_cumulative_command_line_args() { | # get the last interesting option tr ' ' "\n" | - grep "^${OPTION}" + grep "^${OPTION}" | + # normalize quoting of values + sed \ + -e 's/"//g' \ + -e "s/'//g" } # Extract the effective command line arguments for the docker daemon From d2ba1d9f721148eea502791ab8dd9f3199767679 Mon Sep 17 00:00:00 2001 From: Andreas Stieger Date: Tue, 17 Nov 2015 16:16:24 +0100 Subject: [PATCH 4/4] Fix #97, #98, #99 by using new helper functions Signed-off-by: Andreas Stieger --- tests/2_docker_daemon_configuration.sh | 16 ++++++++-------- tests/3_docker_daemon_configuration_files.sh | 12 ++++++------ 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/tests/2_docker_daemon_configuration.sh b/tests/2_docker_daemon_configuration.sh index 242e79c..f0fc82f 100644 --- a/tests/2_docker_daemon_configuration.sh +++ b/tests/2_docker_daemon_configuration.sh @@ -14,7 +14,7 @@ fi # 2.2 check_2_2="2.2 - Restrict network traffic between containers" -get_command_line_args docker | grep "icc=false" >/dev/null 2>&1 +get_docker_effective_command_line_args '--icc' | grep "false" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_2" else @@ -23,7 +23,7 @@ fi # 2.3 check_2_3="2.3 - Set the logging level" -get_command_line_args docker | grep "log-level=\"debug\"" >/dev/null 2>&1 +get_docker_effective_command_line_args '-l' | grep "debug" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_3" else @@ -32,7 +32,7 @@ fi # 2.4 check_2_4="2.4 - Allow Docker to make changes to iptables" -get_command_line_args docker | grep "iptables=false" >/dev/null 2>&1 +get_docker_effective_command_line_args '--iptables' | grep "false" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_4" else @@ -41,7 +41,7 @@ fi # 2.5 check_2_5="2.5 - Do not use insecure registries" -get_command_line_args docker | grep "insecure-registry" >/dev/null 2>&1 +get_docker_effective_command_line_args '--insecure-registry' | grep "insecure-registry" >/dev/null 2>&1 if [ $? -eq 0 ]; then warn "$check_2_5" else @@ -50,7 +50,7 @@ fi # 2.6 check_2_6="2.6 - Setup a local registry mirror" -get_command_line_args docker | grep "registry-mirror" >/dev/null 2>&1 +get_docker_effective_command_line_args '--registry-mirror' | grep "registry-mirror" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_6" else @@ -69,7 +69,7 @@ fi # 2.8 check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" -get_command_line_args docker | grep "\-H" >/dev/null 2>&1 +get_docker_effective_command_line_args '-H' | grep "\-H" >/dev/null 2>&1 if [ $? -eq 0 ]; then info "$check_2_8" info " * Docker daemon running with -H" @@ -79,7 +79,7 @@ fi # 2.9 check_2_9="2.9 - Configure TLS authentication for Docker daemon" -get_command_line_args docker | tr "-" "\n" | grep -E '^(H|host)' | grep -vE '(unix|fd)://' >/dev/null 2>&1 +get_docker_cumulative_command_line_args '-H' | grep -vE '(unix|fd)://' >/dev/null 2>&1 if [ $? -eq 0 ]; then get_command_line_args docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 if [ $? -eq 0 ]; then @@ -96,7 +96,7 @@ fi # 2.10 check_2_10="2.10 - Set default ulimit as appropriate" -get_command_line_args docker | grep "default-ulimit" >/dev/null 2>&1 +get_docker_effective_command_line_args '--default-ulimit' | grep "default-ulimit" >/dev/null 2>&1 if [ $? -eq 0 ]; then pass "$check_2_10" else diff --git a/tests/3_docker_daemon_configuration_files.sh b/tests/3_docker_daemon_configuration_files.sh index d7394ae..b3ff542 100644 --- a/tests/3_docker_daemon_configuration_files.sh +++ b/tests/3_docker_daemon_configuration_files.sh @@ -292,7 +292,7 @@ fi # 3.19 check_3_19="3.19 - Verify that TLS CA certificate file ownership is set to root:root" -tlscacert=$(get_command_line_args docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) +tlscacert=$(get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) if [ -f "$tlscacert" ]; then if [ "$(stat -c %u%g "$tlscacert")" -eq 00 ]; then pass "$check_3_19" @@ -307,7 +307,7 @@ fi # 3.20 check_3_20="3.20 - Verify that TLS CA certificate file permissions are set to 444" -tlscacert=$(get_command_line_args docker | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) +tlscacert=$(get_docker_effective_command_line_args '--tlscacert' | sed -n 's/.*tlscacert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) if [ -f "$tlscacert" ]; then perms=$(ls -ld "$tlscacert" | awk '{print $1}') if [ "$perms" = "-r--r--r--" ]; then @@ -323,7 +323,7 @@ fi # 3.21 check_3_21="3.21 - Verify that Docker server certificate file ownership is set to root:root" -tlscert=$(get_command_line_args docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) +tlscert=$(get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) if [ -f "$tlscert" ]; then if [ "$(stat -c %u%g "$tlscert")" -eq 00 ]; then pass "$check_3_21" @@ -338,7 +338,7 @@ fi # 3.22 check_3_22="3.22 - Verify that Docker server certificate file permissions are set to 444" -tlscert=$(get_command_line_args docker | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) +tlscert=$(get_docker_effective_command_line_args '--tlscert' | sed -n 's/.*tlscert=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) if [ -f "$tlscert" ]; then perms=$(ls -ld "$tlscert" | awk '{print $1}') if [ "$perms" = "-r--r--r--" ]; then @@ -354,7 +354,7 @@ fi # 3.23 check_3_23="3.23 - Verify that Docker server key file ownership is set to root:root" -tlskey=$(get_command_line_args docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) +tlskey=$(get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) if [ -f "$tlskey" ]; then if [ "$(stat -c %u%g "$tlskey")" -eq 00 ]; then pass "$check_3_23" @@ -369,7 +369,7 @@ fi # 3.24 check_3_24="3.24 - Verify that Docker server key file permissions are set to 400" -tlskey=$(get_command_line_args docker | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) +tlskey=$(get_docker_effective_command_line_args '--tlskey' | sed -n 's/.*tlskey=\([^s]\)/\1/p' | sed 's/--/ --/g' | cut -d " " -f 1) if [ -f "$tlskey" ]; then perms=$(ls -ld "$tlskey" | awk '{print $1}') if [ "$perms" = "-r--------" ]; then