aquasecurity / aquasecurity/docker-bench
cis-1.3.1: 5.10 and 5.11 (possibly more checks) don't work properly
- Dominant language
- Go
- Stars
- 222
- Forks
- 69
- PR merge metrics
- No merged PRs in 30d
Description
# Observation
The problem seems to be due to the format of the output returned by the audit command, which contains the container Id.
For example
```
docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}:Memory={{ .HostConfig.Memory }}'
87d3272a4a42fdeb534935bccb9b934f13761fc7e8ba82e233de581213d05359:Memory=268435456
```
is considered a `FAIL` by
```
docker run --memory=256m hello-world:latest
sudo docker-bench --benchmark cis-1.3.1 --include-test-output --config-dir /etc/docker-bench/cfg | grep "] 5.10" -A 1
```
```
[FAIL] 5.10 Ensure that the memory usage for container is limited (Automated)
87d3272a4a42fdeb534935bccb9b934f13761fc7e8ba82e233de581213d05359:Memory=268435456
```
# Possible solution
It seems like the problem can be resolved by using a regex
```
tests:
test_items:
- flag: ".*Memory"
```
instead of
https://github.com/aquasecurity/docker-bench/blob/b6e798b7f0e166a29483353d4a7d66d27c27185d/cfg/cis-1.3.1/definitions.yaml#L1313
# Other affected checks
https://github.com/aquasecurity/docker-bench/blob/b6e798b7f0e166a29483353d4a7d66d27c27185d/cfg/cis-1.3.1/definitions.yaml#L1333 is also affected, possibly more checks are affected.
# System details
```
cat /etc/*release
NAME="openSUSE Leap"
VERSION="15.3"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.3"
PRETTY_NAME="openSUSE Leap 15.3"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.3"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
```
```
docker version
Client:
Version: 20.10.6-ce
API version: 1.41
Go version: go1.13.15
Git commit: 8728dd246c3a
Built: Thu Apr 15 12:00:00 2021
OS/Arch: linux/amd64
Context: default
Experimental: true
Server:
Engine:
Version: 20.10.6-ce
API version: 1.41 (minimum version 1.12)
Go version: go1.13.15
Git commit: 8728dd246c3a
Built: Thu Apr 15 12:00:00 2021
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.4.4
GitCommit: 05f951a3781f4f2c1911b05e61c160e9c30eaa8e
runc:
Version: 1.0.0-rc93
GitCommit: 12644e614e25b05da6fd08a38ffa0cfe1903fdec
docker-init:
Version: 0.1.5_catatonit
GitCommit:
```
docker-bench https://github.com/aquasecurity/docker-bench/releases/tag/v0.5.0 `docker-bench_0.5.0_linux_amd64.rpm`
Contributor guide
Research direction
Start in cfg/cis-1.3.1/definitions.yaml around the referenced lines 1313 and 1333, and run the provided docker-bench command with --benchmark cis-1.3.1 and --include-test-output. Compare the checks' handling of output prefixed by a container ID; done means checks 5.10, 5.11, and any similarly affected checks correctly evaluate the Docker output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, yaml
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100