Skip to content
Permalink
Browse files

Merge pull request #390 from jammasterj89/master

Issue #383 ability to exclude images
Closes #383, #369
  • Loading branch information...
konstruktoid committed Aug 29, 2019
2 parents 495a867 + 3d02432 commit d1934b614e73faecabd748ce9bb81262b74d80b0
Showing with 16 additions and 22 deletions.
  1. +2 −3 README.md
  2. +14 −4 docker-bench-security.sh
  3. +0 −15 tests/4_container_images.sh
@@ -54,9 +54,8 @@ version 1.13.0 or later.
-l FILE optional Log output in FILE
-c CHECK optional Comma delimited list of specific check(s)
-e CHECK optional Comma delimited list of specific check(s) to exclude
-i INCLUDE optional Comma delimited list of patterns within a container name to check
-x EXCLUDE optional Comma delimited list of patterns within a container name to exclude from check
-t TARGET optional Comma delimited list of images name to check
-i INCLUDE optional Comma delimited list of patterns within a container or image name to check
-x EXCLUDE optional Comma delimited list of patterns within a container or image name to exclude from check
```

By default the Docker Bench for Security script will run all available CIS tests
@@ -44,9 +44,8 @@ usage () {
-l FILE optional Log output in FILE
-c CHECK optional Comma delimited list of specific check(s)
-e CHECK optional Comma delimited list of specific check(s) to exclude
-i INCLUDE optional Comma delimited list of patterns within a container name to check
-x EXCLUDE optional Comma delimited list of patterns within a container name to exclude from check
-t TARGET optional Comma delimited list of images name to check
-i INCLUDE optional Comma delimited list of patterns within a container or image name to check
-x EXCLUDE optional Comma delimited list of patterns within a container or image name to exclude from check
EOF
}

@@ -63,7 +62,6 @@ do
e) checkexclude="$OPTARG" ;;
i) include="$OPTARG" ;;
x) exclude="$OPTARG" ;;
t) imgList="$OPTARG" ;;
*) usage; exit 1 ;;
esac
done
@@ -103,15 +101,27 @@ main () {
benchcont="$c"
fi
done

# get the image id of the docker_bench_security_image, memorize it:
benchimagecont="nil"
for c in $(docker images | sed '1d' | awk '{print $3}'); do
if docker inspect --format '{{ .Config.Labels }}' "$c" | \
grep -e 'docker.bench.security' >/dev/null 2>&1; then
benchimagecont="$c"
fi
done

if [ -n "$include" ]; then
pattern=$(echo "$include" | sed 's/,/|/g')
containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont" | grep -E "$pattern")
images=$(docker images | grep -E "$pattern" | sed '1d' | awk '{print $3}' | grep -v "$benchimagecont")
elif [ -n "$exclude" ]; then
pattern=$(echo "$exclude" | sed 's/,/|/g')
containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont" | grep -Ev "$pattern")
images=$(docker images | grep -Ev "$pattern" | sed '1d' | awk '{print $3}' | grep -v "$benchimagecont")
else
containers=$(docker ps | sed '1d' | awk '{print $NF}' | grep -v "$benchcont")
images=$(docker images -q | grep -v "$benchcont")
fi

if [ -z "$containers" ]; then
@@ -1,20 +1,5 @@
#!/bin/sh

if [ -n "$imgList" ]; then
pattern=$(echo "$imgList" | sed 's/,/ /g')
for img in $pattern; do
echo "Looking for image $img"
sha256=$(docker image ls "$img" -q)
if [ -z "$sha256" ]; then
echo "Image $img not found. Exiting."
exit 1
fi
images="$images $sha256 "
done
else
images=$(docker images -q)
fi

check_4() {
logit "\n"
id_4="4"

0 comments on commit d1934b6

Please sign in to comment.
You can’t perform that action at this time.