aquasecurity / aquasecurity/docker-bench

cis-1.3.1: 5.10 and 5.11 (possibly more checks) don't work properly

Open
#101 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
222
Forks
69
PR merge metrics
No merged PRs in 30d

Description

# Observation

The problem seems to be due to the format of the output returned by the audit command, which contains the container Id.
For example

```
docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}:Memory={{ .HostConfig.Memory }}'
87d3272a4a42fdeb534935bccb9b934f13761fc7e8ba82e233de581213d05359:Memory=268435456
```

is considered a `FAIL` by

```
docker run --memory=256m hello-world:latest
sudo docker-bench --benchmark cis-1.3.1 --include-test-output --config-dir /etc/docker-bench/cfg | grep "] 5.10" -A 1
```

```
[FAIL] 5.10 Ensure that the memory usage for container is limited (Automated)
87d3272a4a42fdeb534935bccb9b934f13761fc7e8ba82e233de581213d05359:Memory=268435456
```

# Possible solution

It seems like the problem can be resolved by using a regex

```
tests:
test_items:
- flag: ".*Memory"
```

instead of

https://github.com/aquasecurity/docker-bench/blob/b6e798b7f0e166a29483353d4a7d66d27c27185d/cfg/cis-1.3.1/definitions.yaml#L1313

# Other affected checks

https://github.com/aquasecurity/docker-bench/blob/b6e798b7f0e166a29483353d4a7d66d27c27185d/cfg/cis-1.3.1/definitions.yaml#L1333 is also affected, possibly more checks are affected.

# System details

```
cat /etc/*release
NAME="openSUSE Leap"
VERSION="15.3"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.3"
PRETTY_NAME="openSUSE Leap 15.3"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.3"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
```

```
docker version
Client:
Version: 20.10.6-ce
API version: 1.41
Go version: go1.13.15
Git commit: 8728dd246c3a
Built: Thu Apr 15 12:00:00 2021
OS/Arch: linux/amd64
Context: default
Experimental: true

Server:
Engine:
Version: 20.10.6-ce
API version: 1.41 (minimum version 1.12)
Go version: go1.13.15
Git commit: 8728dd246c3a
Built: Thu Apr 15 12:00:00 2021
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.4.4
GitCommit: 05f951a3781f4f2c1911b05e61c160e9c30eaa8e
runc:
Version: 1.0.0-rc93
GitCommit: 12644e614e25b05da6fd08a38ffa0cfe1903fdec
docker-init:
Version: 0.1.5_catatonit
GitCommit:
```

docker-bench https://github.com/aquasecurity/docker-bench/releases/tag/v0.5.0 `docker-bench_0.5.0_linux_amd64.rpm`

Contributor guide

Open the contributing guide

Research direction

Start in cfg/cis-1.3.1/definitions.yaml around the referenced lines 1313 and 1333, and run the provided docker-bench command with --benchmark cis-1.3.1 and --include-test-output. Compare the checks' handling of output prefixed by a container ID; done means checks 5.10, 5.11, and any similarly affected checks correctly evaluate the Docker output.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, yaml
Domain
devops, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.