GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-31 14:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix for issue #47.

Browse source 
Introduces a new function in helper_lib.sh to query the command line
arguments of the running instances of a binary. This is done to get
rid of the problem of "-lf" versus "-alf" for pgrep.

Signed-off-by: Joachim Lusiardi <joachim@lusiardi.de>
This commit is contained in:
Joachim Lusiardi 2015-06-22 21:36:56 +02:00 committed by Joachim Lusiardi
parent 62a903246c
commit fc8eefb8a6
2 changed files with 21 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
helper_lib.sh
View file

@ -36,3 +36,13 @@ contains() {
return 1 # $substring is not in $string return 1 # $substring is not in $string
fi fi
} }
# Extracts all commandline args from all running processes named like the first parameter
get_command_line_args() {
PROC="$1"
for PID in `pgrep $PROC`
do
cat /proc/$PID/cmdline | tr "\0" " "
done
}

21
tests/2_docker_daemon_configuration.sh
View file

@ -5,7 +5,7 @@ info "2 - Docker Daemon Configuration"
# 2.1 # 2.1
check_2_1="2.1 - Do not use lxc execution driver" check_2_1="2.1 - Do not use lxc execution driver"
pgrep -lf docker | grep lxc >/dev/null 2>&1 get_command_line_args docker | grep lxc >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_1" warn "$check_2_1"
else else
@ -14,7 +14,7 @@ fi
# 2.2 # 2.2
check_2_2="2.2 - Restrict network traffic between containers" check_2_2="2.2 - Restrict network traffic between containers"
pgrep -lf docker | grep "icc=false" >/dev/null 2>&1 get_command_line_args docker | grep "icc=false" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_2" pass "$check_2_2"
else else
@ -23,7 +23,7 @@ fi
# 2.3 # 2.3
check_2_3="2.3 - Set the logging level" check_2_3="2.3 - Set the logging level"
pgrep -lf docker | grep "log-level=\"debug\"" >/dev/null 2>&1 get_command_line_args docker | grep "log-level=\"debug\"" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_3" warn "$check_2_3"
else else
@ -32,7 +32,7 @@ fi
# 2.4 # 2.4
check_2_4="2.4 - Allow Docker to make changes to iptables" check_2_4="2.4 - Allow Docker to make changes to iptables"
pgrep -lf docker | grep "iptables=false" >/dev/null 2>&1 get_command_line_args docker | grep "iptables=false" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_4" warn "$check_2_4"
else else
@ -41,7 +41,7 @@ fi
# 2.5 # 2.5
check_2_5="2.5 - Do not use insecure registries" check_2_5="2.5 - Do not use insecure registries"
pgrep -lf docker | grep "insecure-registry" >/dev/null 2>&1 get_command_line_args docker | grep "insecure-registry" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
warn "$check_2_5" warn "$check_2_5"
else else
@ -50,7 +50,7 @@ fi
# 2.6 # 2.6
check_2_6="2.6 - Setup a local registry mirror" check_2_6="2.6 - Setup a local registry mirror"
pgrep -lf docker | grep "registry-mirror" >/dev/null 2>&1 get_command_line_args docker | grep "registry-mirror" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_6" pass "$check_2_6"
else else
@ -69,7 +69,7 @@ fi
# 2.8 # 2.8
check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket" check_2_8="2.8 - Do not bind Docker to another IP/Port or a Unix socket"
pgrep -lf docker | grep "\-H" >/dev/null 2>&1 get_command_line_args docker | grep "\-H" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
info "$check_2_8" info "$check_2_8"
info " * Docker daemon running with -H" info " * Docker daemon running with -H"
@ -79,9 +79,9 @@ fi
# 2.9 # 2.9
check_2_9="2.9 - Configure TLS authentication for Docker daemon" check_2_9="2.9 - Configure TLS authentication for Docker daemon"
pgrep -lf docker | grep "\-H" >/dev/null 2>&1 get_command_line_args docker | grep "\-H" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pgrep -lf docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1 get_command_line_args docker | grep "tlsverify" | grep "tlskey" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_9" pass "$check_2_9"
info " * Docker daemon currently listening on TCP" info " * Docker daemon currently listening on TCP"
@ -96,10 +96,11 @@ fi
# 2.10 # 2.10
check_2_10="2.10 - Set default ulimit as appropriate" check_2_10="2.10 - Set default ulimit as appropriate"
pgrep -lf docker | grep "default-ulimit" >/dev/null 2>&1 get_command_line_args docker | grep "default-ulimit" >/dev/null 2>&1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
pass "$check_2_10" pass "$check_2_10"
else else
info "$check_2_10" info "$check_2_10"
info " * Default ulimit doesn't appear to be set" info " * Default ulimit doesn't appear to be set"
fi fi