GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity

add -e option to exclude checks

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2018-05-10 14:45:59 +02:00
parent d03f69931c
commit f78145214a
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -51,7 +51,8 @@ version 1.13.0 or later.
-h optional Print this help message -h optional Print this help message
-l FILE optional Log output in FILE -l FILE optional Log output in FILE
-c CHECK optional Comma delimited list of specific check(s) -c CHECK optional Comma delimited list of specific check(s)
-x EXCLUDE optional Comma delimited list of patterns within a container to exclude from check -e CHECK optional Comma delimited list of specific check(s) to exclude
-x EXCLUDE optional Comma delimited list of patterns within a container name to exclude from check
``` ```
By default the Docker Bench for Security script will run all available CIS tests By default the Docker Bench for Security script will run all available CIS tests

14
docker-bench-security.sh
View file

@ -38,6 +38,7 @@ usage () {
-h optional Print this help message -h optional Print this help message
-l FILE optional Log output in FILE -l FILE optional Log output in FILE
-c CHECK optional Comma delimited list of specific check(s) -c CHECK optional Comma delimited list of specific check(s)
-e CHECK optional Comma delimited list of specific check(s) to exclude
-x EXCLUDE optional Comma delimited list of patterns within a container name to exclude from check -x EXCLUDE optional Comma delimited list of patterns within a container name to exclude from check
EOF EOF
} }
@ -45,12 +46,13 @@ EOF
# Get the flags # Get the flags
# If you add an option here, please # If you add an option here, please
# remember to update usage() above. # remember to update usage() above.
while getopts hl:c:x: args while getopts hl:c:e:x: args
do do
case $args in case $args in
h) usage; exit 0 ;; h) usage; exit 0 ;;
l) logger="$OPTARG" ;; l) logger="$OPTARG" ;;
c) check="$OPTARG" ;; c) check="$OPTARG" ;;
e) checkexclude="$OPTARG" ;;
x) exclude="$OPTARG" ;; x) exclude="$OPTARG" ;;
*) usage; exit 1 ;; *) usage; exit 1 ;;
esac esac
@ -121,11 +123,15 @@ main () {
. ./"$test" . ./"$test"
done done
if [ -z "$check" ]; then if [ -z "$check" ] && [ ! "$checkexclude" ] ; then
cis cis
elif [ -z "$check" ] && [ "$checkexclude" ]; then
checkexcluded="$(echo $checkexclude | sed 's/,/|/g')"
for c in $(grep 'check_[0-9]_' functions_lib.sh | grep -vE "$checkexcluded"); do
"$c"
done
else else
for i in $(echo "$check" | sed "s/,/ /g") for i in $(echo "$check" | sed "s/,/ /g"); do
do
if command -v "$i" 2>/dev/null 1>&2; then if command -v "$i" 2>/dev/null 1>&2; then
"$i" "$i"
else else