GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-19 00:32:34 +01:00
Code Issues Projects Releases Packages Wiki Activity
771 commits 3 branches 11 tags 4.9 MiB
Commit graph

269 commits

Author SHA1 Message Date
Thomas Sjögren
bcd6e5dd55 json sections 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 16:10:59 +02:00
Thomas Sjögren
ca3714bc16 first pass on section 7 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 16:03:29 +02:00
Thomas Sjögren
3d6dd81956 first pass on section 6 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 15:52:06 +02:00
Thomas Sjögren
0b007baf7e first pass on section 5 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 15:43:29 +02:00
Thomas Sjögren
e5c22c5f01 first pass on section 4 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 15:25:54 +02:00
Thomas Sjögren
f968597051 first pass on section 3 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 15:13:19 +02:00
Thomas Sjögren
6c6d0836a4 first pass on section 2 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 14:54:08 +02:00
Thomas Sjögren
82644982a8 move old 2.13 to community checks 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-27 14:53:42 +02:00
Thomas Sjögren
d963b93fcc update info output 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-26 15:13:50 +02:00
Thomas Sjögren
28f16f0afd add 1.2.9, #ref https://github.com/docker/docker-bench-security/pull/359 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-26 14:41:37 +02:00
Thomas Sjögren
6105f02a16 first pass on section 1 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-08-26 14:37:25 +02:00
Thomas Sjögren
326e31f403 use only year and month for version check #309 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-04-13 16:33:57 +02:00
Thomas Sjögren
1c8699bcf3 revert grep thought fail 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-03-20 09:57:19 +01:00
Thomas Sjögren
740439d352 accept only if ADD in / #362 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-03-19 14:54:38 +01:00
Thomas Sjögren
cec124a162 exclude first ADD since its most often the base #362 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-03-19 14:27:02 +01:00
Thomas Sjögren
d942b12e0a INFO shouldnt increase score #362 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-03-14 10:32:39 +01:00
Boris Gorbylev
689a5a62c5
Fixed check 2.9 
Signed-off-by: Boris Gorbylev <ekho@ekho.name>
 2019-02-21 19:15:38 +03:00
Thomas Sjögren
7e3ecaf17d catch root with uid and name as well #358 CVE-2019-5736 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-02-13 14:58:34 +01:00
Thomas Sjögren
a911c23915 4.9 resulttestjson "INFO" #356 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2019-01-24 16:46:51 +01:00
Anthony Roger
1dd7956760 feat: add the ability to select the images to be check from registry in order to integrate in ci 
Signed-off-by: Anthony Roger <aroger@softwaymedical.fr>
 2018-12-11 14:39:16 +01:00
telepresencebot2
4bf876296a fix test 7.4 using 5.25 as a model 
Signed-off-by: Taylor Lucy <talucy@franklinamerican.com>
 2018-11-14 14:30:51 -06:00
Thomas Sjögren
391e09f76a linting 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-11-01 10:24:36 +01:00
Thomas Sjögren
d5b900ce05 use mountpoint and DockerRootDir #332 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-10-23 15:26:41 +02:00
Mark Stemm
ec7d8ce690 Improve docker-bench-security json output 
Add a test object for each test performed by the script. Each object has
an id N.M, a desc property describing the test, and the result. Some
tests include additional information about the test e.g. "No TLS
Certificate Found". That can be found in an optional details property of
the test object.

Also, some tests might also return a list of containers, images, users,
etc. This is included in an optional items property of the test object.

Instead of having all test results as top-level objects, break the test
results into sections. Each section has an id + description e.g. "1" and
"Host Configuration". The tests for that section are an array below that
object.

All of the additional json output is implemented by adding new functions
startsectionjson(), endsectionjson(), starttestjson(), and
resulttestjson() that take the id/desc/etc as arguments and print the
proper json properties. It also required adding an "end" test to each
script that calls endsectionjson().

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2018-10-11 13:39:55 -07:00
Thomas Sjögren
773625a894 ref #325 daemon.json permissions 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-09-27 09:49:32 +02:00
Thomas Sjögren
feced0f6b2
Merge pull request #313 from nbrownuk/issue295-fix-tls-config-check 
Fixes incorrect reporting of TLS configuration in test 2.6
 2018-08-08 11:58:47 +02:00
Thomas Sjögren
f1137cd36a dont decrease 5.29 #316 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-08-06 09:51:06 +02:00
Joe Williams
cfb3357a12 fix docker user json output 
This prints out the docker users in a similar fashion to the other tests, including `INFO` rather than just the system command output.

Signed-off-by: Joe Williams <joe.williams@github.com>
 2018-07-26 15:07:59 -04:00
Nigel Brown
167c3507a2 Fixes incorrect reporting of TLS configuration in test 2.6 
Signed-off-by: Nigel Brown <nigel@windsock.io>
 2018-07-10 14:35:30 +01:00
Thomas Sjögren
c8894d3b26 deprecated --disable-legacy-registry 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-07-01 20:53:20 +02:00
Thomas Sjögren
78700f2600 consistent currentScore 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-07-01 20:04:20 +02:00
Thomas Sjögren
ebfb20c65f 4.7 is not scored 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-07-01 20:01:10 +02:00
Daniele Marcocci
77074962b1 fix count total_containers for swarm mode 
Signed-off-by: Daniele Marcocci <daniele.marcocci@par-tec.it>
 2018-05-18 10:17:42 +02:00
Mike Ritter
a3094ac5c6 New Features 
Signed-off-by: Mike Ritter <mike.ritter@target.com>
 2018-02-27 08:43:51 -06:00
Thomas Sjögren
bdeaeaa05a fix 2.18 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-02-09 11:02:04 +01:00
Thomas Sjögren
2aa9719dd6 silence example check output 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-01-18 11:29:20 +01:00
Thomas Sjögren
8fe0b5ea02 add example community check 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-01-17 16:11:04 +01:00
Thomas Sjögren
8142de8334 convert all checks to functions 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-01-16 13:46:49 +01:00
Thomas Sjögren
25b40c94a2
Merge branch 'master' into issue265 2018-01-12 11:49:04 +01:00
Thomas Sjögren
ce5ab6b063 update version check 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-01-12 11:42:52 +01:00
Thomas Sjögren
57acb04a96 catch seccomp:unconfined|seccomp=unconfined 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-01-12 11:36:14 +01:00
Thomas Sjögren
bdba64c8c0
Merge pull request #280 from konstruktoid/version 
adapt to 18.01 docker version
 2018-01-12 11:09:47 +01:00
Thomas Sjögren
e0a302eb40 adapt to 18.01 docker version 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2018-01-12 11:09:16 +01:00
Karol Babioch
997ce7330e Replace netstat by ss 
ss(8) is a modern replacement for netstat(8). The former is slowly replacing
the latter in major Linux distributions, which makes it necessary to switch
at some point.

This addresses #278.

Signed-off-by: Karol Babioch <kbabioch@suse.de>
 2018-01-11 16:52:54 +01:00
Thomas Sjögren
976463a87b add score and totalChecks to 7_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:41:15 +02:00
Thomas Sjögren
7ebe21823d add score and totalChecks to 6_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:41:03 +02:00
Thomas Sjögren
e32910172f add score and totalChecks to 5_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:40:52 +02:00
Thomas Sjögren
de82250274 add score and totalChecks to 4_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:40:12 +02:00
Thomas Sjögren
f9be3996f4 add score and totalChecks to 3_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:39:52 +02:00
Thomas Sjögren
ec4060ea2f add score and totalChecks to 2_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:39:32 +02:00
Thomas Sjögren
3d532a29ac add score and totalChecks to 1_ 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-23 15:39:18 +02:00
Thomas Sjögren
fa9b227a7b check 7.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-13 10:38:31 +02:00
Thomas Sjögren
e1adab029d check 6.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-13 10:28:42 +02:00
Thomas Sjögren
be4dd69f3f check 5.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-13 10:25:23 +02:00
Thomas Sjögren
b8fac4a7d2 check 4.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-13 10:02:48 +02:00
Thomas Sjögren
7a1b813cdc check 3.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-13 09:53:15 +02:00
Thomas Sjögren
78b1f5dc86 check 2.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-10 14:46:08 +02:00
Thomas Sjögren
a3612c574e check 1.x json log 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-10 14:33:32 +02:00
Thomas Sjögren
809da21c4a skeleton json 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-10-10 13:54:59 +02:00
Thomas Sjögren
d062b1edce Merge pull request #256 from konstruktoid/date_255 
busybox date conversion
 2017-10-06 09:57:41 +02:00
Thomas Sjögren
4ec0962704 Merge pull request #257 from jgsqware/2-14-check-dockerd 
update 2.14
 2017-09-21 10:18:34 +02:00
Julien Garcia Gonzalez
683a728364 update 1.1 
Signed-off-by: Julien Garcia Gonzalez <julien@giantswarm.io>
 2017-09-21 08:53:07 +02:00
Julien Garcia Gonzalez
1d07abf659
update 2.14 2017-09-21 08:15:09 +02:00
Thomas Sjögren
f8354c1017 busybox date conversion 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-09-20 11:10:36 +02:00
Thomas Sjögren
44e46c63c3 spaces 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 13:06:23 +02:00
Thomas Sjögren
84baf80b7d no short forms 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 13:03:45 +02:00
Thomas Sjögren
565ef3fb3b redirect errors 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 13:03:10 +02:00
Thomas Sjögren
73afde56d0 date conversion 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:38:21 +02:00
Thomas Sjögren
6f0303ef56 versioning 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:31:22 +02:00
Thomas Sjögren
00c2d6e796 docker date versioning 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:24:03 +02:00
Thomas Sjögren
dac6a62ba1 space 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:10:37 +02:00
Thomas Sjögren
5bf4f824a4 pass 7.7 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:08:31 +02:00
Thomas Sjögren
125eaf90cd inspect requires images 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:07:00 +02:00
Thomas Sjögren
60afd7ec83 7.7 verify swarm 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 12:05:42 +02:00
Thomas Sjögren
789af6d8d6 add Docker Swarm Configuration tests 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 11:43:15 +02:00
Thomas Sjögren
e1e902b3ed update checks 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 11:19:02 +02:00
Thomas Sjögren
88b48315bc update checks 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 11:16:49 +02:00
Thomas Sjögren
efa3b4522f update check names 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 10:56:18 +02:00
Thomas Sjögren
03974c0854 update titles and tests 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 10:37:09 +02:00
Thomas Sjögren
d93bc6b075 update section 2, clean tests 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 10:23:40 +02:00
Thomas Sjögren
2dd6f2ebec update test names 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-07-07 10:21:38 +02:00
Thomas Sjögren
e5afda701f auto update due to new versioning 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-05-08 14:58:16 +02:00
Thomas Sjögren
986aaa67fb supress grep is auditd rules is missing 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-04-21 14:24:02 +02:00
Thomas Sjögren
5d9101cfc2 .Server.Experimental pre-1.13 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-04-21 13:51:09 +02:00
Thomas Sjögren
17ee45ba94 test tls get_docker_configuration_file_args 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-03-23 15:28:06 +01:00
Thomas Sjögren
a97bdfbe0d add note tag on informal checks 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-03-23 11:29:58 +01:00
Thomas Sjögren
6105ff6641 use stat when checking permissions 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-03-22 15:23:04 +01:00
Thomas Sjögren
754e0ed02b tlsverify implies tls 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-03-21 16:17:08 +01:00
Thomas Sjögren
91e625b8e4 Modify get_docker_configuration_file_args in order to handle daemon.json better, 
and also address missing files issue.

Closes #231
Closes #232

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-03-21 14:49:42 +01:00
Thomas Sjögren
bbdfa0015e new versioning 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-03-02 13:29:01 +01:00
Thomas Sjögren
260a3a76f1 Merge pull request #225 from andreasstieger/netstat 
2.17: correct netstat usage and filtering
 2017-02-24 13:26:48 +01:00
Andreas Stieger
c30a43c1fd 2.17: account for :::2377 netstat output 
Fixes #224 - no. 4

Signed-off-by: Andreas Stieger <astieger@suse.com>
 2017-02-24 13:24:02 +01:00
Andreas Stieger
421c6dd866 2.17: may incorrectly match 5 digit port numbers 
Fixes #224 - no. 3

Signed-off-by: Andreas Stieger <astieger@suse.com>
 2017-02-24 13:23:57 +01:00
Andreas Stieger
7c66b6373a 2.17: grep -e recognizes IPv4 separator any character - escape 
Fixes #224 - no. 2

Signed-off-by: Andreas Stieger <astieger@suse.com>
 2017-02-24 13:23:48 +01:00
Andreas Stieger
c15dc6c568 2.17: netstat non-numeric output may not interpreted correctly 
The port may be aliased in /etc/services
Fixes #224 - no. 1

Signed-off-by: Andreas Stieger <astieger@suse.com>
 2017-02-24 13:23:33 +01:00
Thomas Sjögren
3d87e6d743 Merge pull request #218 from konstruktoid/issue_157 
Check configuration file settings
 2017-02-24 11:28:50 +01:00
Thomas Sjögren
011ec950e9 use docker info, as all other tests 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-02-23 17:07:33 +01:00
Thomas Sjögren
7787fc0ec9 correct check_2_21, closes #221 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-02-23 17:01:47 +01:00
Thomas Sjögren
91eb958dd3 get file locations from config file 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-02-23 16:33:54 +01:00
Thomas Sjögren
7575020fd5 check config file settings 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2017-02-23 16:33:53 +01:00