Skip to content

Commit c3746ff

Browse files
atomic111atomic111
authored
Merge pull request #30 from dev-sec/chris-rock/1.12
fix #11 implement missing 1.12 controls
2 parents a0114ae + 87b290e commit c3746ff

File tree

7 files changed

+245
-6
lines changed

7 files changed

+245
-6
lines changed

‎README.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,16 @@ We use a yml attribute file to steer the configuration, the following options ar
6969
* `daemon_tlskey: /etc/docker/ssl/server_key.pem`
7070
configure the server key. cis-docker-benchmark-2.6
7171

72-
* `swarm_mode: Swarm: inactive`
72+
* `swarm_mode: inactive`
7373
configure the swarm mode. cis-docker-benchmark-2.15
7474

75+
* `swarm_max_manager_nodes: 3`
76+
configure the maximum number of swarm leaders. cis-docker-benchmark-2.16
77+
78+
* `swarm_port: 2377`
79+
configure the swarm port. cis-docker-benchmark-2.17
80+
81+
7582
## Usage
7683

7784
InSpec makes it easy to run your tests wherever you need. More options listed here: [InSpec cli](http://inspec.io/docs/reference/cli/)
@@ -97,6 +104,14 @@ inspec exec cis-docker-benchmark --attrs sample_attributes.yml
97104
inspec supermarket exec dev-sec/cis-docker-benchmark -t ssh://user@hostname --key-files private_key --sudo
98105
```
99106

107+
### Run individual controls
108+
109+
In order to verify individual controls, just provide the control ids to InSpec:
110+
111+
```
112+
inspec exec cis-docker-benchmark --controls 'cis-docker-benchmark-1.4 cis-docker-benchmark-1.5'
113+
```
114+
100115
## Contributors + Kudos
101116

102117
* Patrick Muench [atomic111](https://github.com/atomic111)

‎controls/container_images.rb‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# frozen_string_literal: true
33
#
44
# Copyright 2016, Patrick Muench
5+
# Copyright 2017, Christoph Hartmann
56
#
67
# Licensed under the Apache License, Version 2.0 (the "License");
78
# you may not use this file except in compliance with the License.
@@ -111,3 +112,75 @@
111112
its('content') { should eq '1' }
112113
end
113114
end
115+
116+
control 'cis-docker-benchmark-4.6' do
117+
impact 0.0
118+
title 'Add HEALTHCHECK instruction to the container image'
119+
120+
tag 'daemon'
121+
tag cis: 'docker:4.6'
122+
tag level: 1
123+
124+
docker.containers.running?.ids.each do |id|
125+
describe docker.object(id) do
126+
its(%w(Config Healthcheck)) { should_not eq nil }
127+
end
128+
end
129+
end
130+
131+
control 'cis-docker-benchmark-4.7' do
132+
impact 0.0
133+
title 'Do not use update instructions alone in the Dockerfile'
134+
135+
tag 'daemon'
136+
tag cis: 'docker:4.6'
137+
tag level: 1
138+
139+
docker.images.ids.each do |id|
140+
describe command("docker history #{id}| grep -e 'update'") do
141+
its('stdout') { should eq '' }
142+
end
143+
end
144+
end
145+
146+
control 'cis-docker-benchmark-4.8' do
147+
impact 0.0
148+
title 'Remove setuid and setgid permissions in the images'
149+
150+
tag 'daemon'
151+
tag cis: 'docker:4.8'
152+
tag level: 2
153+
ref url: 'https://github.com/dev-sec/linux-baseline'
154+
155+
describe 'docker-test' do
156+
skip 'Use DevSec Linux Baseline in Container'
157+
end
158+
end
159+
160+
control 'cis-docker-benchmark-4.9' do
161+
impact 0.3
162+
title 'Use COPY instead of ADD in Dockerfile'
163+
164+
tag 'daemon'
165+
tag cis: 'docker:4.9'
166+
tag level: 1
167+
168+
docker.images.ids.each do |id|
169+
describe command("docker history #{id}| grep 'ADD'") do
170+
its('stdout') { should eq '' }
171+
end
172+
end
173+
end
174+
175+
control 'cis-docker-benchmark-4.10' do
176+
impact 0.0
177+
title 'Do not store secrets in Dockerfiles'
178+
179+
tag 'daemon'
180+
tag cis: 'docker:4.10'
181+
tag level: 1
182+
183+
describe 'docker-test' do
184+
skip 'Manually verify that you have not used secrets in images'
185+
end
186+
end

‎controls/container_runtime.rb‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# frozen_string_literal: true
33
#
44
# Copyright 2016, Patrick Muench
5+
# Copyright 2017, Christoph Hartmann
56
#
67
# Licensed under the Apache License, Version 2.0 (the "License");
78
# you may not use this file except in compliance with the License.
@@ -530,3 +531,92 @@
530531
end
531532
end
532533
end
534+
535+
control 'cis-docker-benchmark-5.26' do
536+
impact 1.0
537+
title 'Check container health at runtime'
538+
539+
tag 'daemon'
540+
tag cis: 'docker:5.26'
541+
tag level: 1
542+
543+
docker.containers.running?.ids.each do |id|
544+
describe docker.object(id) do
545+
its('State.Health.Status') { should eq 'healthy' }
546+
end
547+
end
548+
end
549+
550+
control 'cis-docker-benchmark-5.27' do
551+
impact 0.0
552+
title 'Ensure docker commands always get the latest version of the image'
553+
554+
tag 'daemon'
555+
tag cis: 'docker:5.27'
556+
tag level: 1
557+
558+
describe 'docker-test' do
559+
skip 'Not implemented yet'
560+
end
561+
end
562+
563+
control 'cis-docker-benchmark-5.28' do
564+
impact 1.0
565+
title 'Use PIDs cgroup limit'
566+
567+
tag 'daemon'
568+
tag cis: 'docker:5.28'
569+
tag level: 1
570+
571+
docker.containers.running?.ids.each do |id|
572+
describe docker.object(id) do
573+
its('HostConfig.PidsLimit') { should_not cmp 0 }
574+
its('HostConfig.PidsLimit') { should_not cmp(-1) }
575+
end
576+
end
577+
end
578+
579+
control 'cis-docker-benchmark-5.29' do
580+
impact 0.0
581+
title "Do not use Docker's default bridge docker0"
582+
583+
tag 'daemon'
584+
tag cis: 'docker:5.29'
585+
tag level: 2
586+
587+
describe 'docker-test' do
588+
skip 'Not implemented yet'
589+
end
590+
end
591+
592+
control 'cis-docker-benchmark-5.30' do
593+
impact 1.0
594+
title "Do not share the host's user namespaces"
595+
596+
tag 'daemon'
597+
tag cis: 'docker:5.30'
598+
tag level: 1
599+
600+
docker.containers.running?.ids.each do |id|
601+
describe docker.object(id) do
602+
its('HostConfig.UsernsMode') { should eq '' }
603+
end
604+
end
605+
end
606+
607+
control 'cis-docker-benchmark-5.31' do
608+
impact 1.0
609+
title 'Do not mount the Docker socket inside any containers'
610+
611+
tag 'daemon'
612+
tag cis: 'docker:5.31'
613+
tag level: 1
614+
615+
docker.containers.running?.ids.each do |id|
616+
docker.object(id).Mounts.each do |mount|
617+
describe mount do
618+
its('Source') { should_not include 'docker.sock' }
619+
end
620+
end
621+
end
622+
end

‎controls/docker_daemon_configuration.rb‎

Lines changed: 63 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# frozen_string_literal: true
33
#
44
# Copyright 2016, Patrick Muench
5+
# Copyright 2017, Christoph Hartmann
56
#
67
# Licensed under the Apache License, Version 2.0 (the "License");
78
# you may not use this file except in compliance with the License.
@@ -59,9 +60,21 @@
5960
)
6061

6162
SWARM_MODE = attribute(
62-
'SWARM_MODE',
63-
description: 'define the swarm mode, active or inactive',
64-
default: 'Swarm: inactive'
63+
'swarm_mode',
64+
description: 'define the swarm mode, `active` or `inactive`',
65+
default: 'inactive'
66+
)
67+
68+
SWARM_MAX_MANAGER_NODES = attribute(
69+
'swarm_max_manager_nodes',
70+
description: 'number of manager nodes in a swarm',
71+
default: 3
72+
)
73+
74+
SWARM_PORT = attribute(
75+
'swarm_port',
76+
description: 'port of the swarm node',
77+
default: 2377
6578
)
6679

6780
# check if docker exists
@@ -319,8 +332,53 @@
319332
tag cis: 'docker:2.15'
320333
tag level: 2
321334
ref 'docker swarm init', url: 'https://docs.docker.com/engine/reference/commandline/swarm_init/'
335+
describe docker.info do
336+
its('Swarm.LocalNodeState') { should eq SWARM_MODE }
337+
end
338+
end
339+
340+
control 'cis-docker-benchmark-2.16' do
341+
impact 1.0
342+
title 'Control the number of manager nodes in a swarm'
343+
desc 'Ensure that the minimum number of required manager nodes is created in a swarm.'
322344

323-
describe command('docker info') do
324-
its('stdout') { should include SWARM_MODE }
345+
tag 'daemon'
346+
tag cis: 'docker:2.16'
347+
tag level: 2
348+
349+
only_if { SWARM_MODE == 'active' }
350+
describe docker.info do
351+
its('Swarm.Managers') { should cmp <= SWARM_MAX_MANAGER_NODES }
352+
end
353+
end
354+
355+
control 'cis-docker-benchmark-2.17' do
356+
impact 1.0
357+
title 'Bind swarm services to a specific host interface'
358+
359+
tag 'daemon'
360+
tag cis: 'docker:2.17'
361+
tag level: 2
362+
363+
only_if { SWARM_MODE == 'active' }
364+
describe port(SWARM_PORT) do
365+
its('addresses') { should_not include '0.0.0.0' }
366+
its('addresses') { should_not include '::' }
367+
end
368+
end
369+
370+
control 'cis-docker-benchmark-2.18' do
371+
impact 1.0
372+
title 'Disable Userland Proxy'
373+
374+
tag 'daemon'
375+
tag cis: 'docker:2.18'
376+
tag level: 2
377+
378+
describe json('/etc/docker/daemon.json') do
379+
its(['userland-proxy']) { should eq(false) }
380+
end
381+
describe processes('dockerd').commands do
382+
it { should include 'userland-proxy=false' }
325383
end
326384
end

‎controls/docker_daemon_configuration_files.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# frozen_string_literal: true
33
#
44
# Copyright 2016, Patrick Muench
5+
# Copyright 2017, Christoph Hartmann
56
#
67
# Licensed under the Apache License, Version 2.0 (the "License");
78
# you may not use this file except in compliance with the License.

‎controls/docker_security_operations.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# frozen_string_literal: true
33
#
44
# Copyright 2016, Patrick Muench
5+
# Copyright 2017, Christoph Hartmann
56
#
67
# Licensed under the Apache License, Version 2.0 (the "License");
78
# you may not use this file except in compliance with the License.

‎controls/host_configuration.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# frozen_string_literal: true
33
#
44
# Copyright 2016, Patrick Muench
5+
# Copyright 2017, Christoph Hartmann
56
#
67
# Licensed under the Apache License, Version 2.0 (the "License");
78
# you may not use this file except in compliance with the License.

0 commit comments

Comments
 (0)