From 7f0fbcf359fb3f15735991923b391f44a0345bf1 Mon Sep 17 00:00:00 2001 From: mboelen Date: Wed, 27 May 2015 12:34:01 +0200 Subject: [PATCH] Initial import for container category --- include/tests_containers | 167 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 167 insertions(+) create mode 100644 include/tests_containers diff --git a/include/tests_containers b/include/tests_containers new file mode 100644 index 00000000..d6450c95 --- /dev/null +++ b/include/tests_containers @@ -0,0 +1,167 @@ +#!/bin/sh + +################################################################################# +# +# Lynis +# ------------------ +# +# Copyright 2007-2015, Michael Boelen (michael.boelen@cisofy.com) +# Web site: https://cisofy.com +# +# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are +# welcome to redistribute it under the terms of the GNU General Public License. +# See LICENSE file for usage of this software. +# +################################################################################# +# +# Containers, Zones, Jails +# +################################################################################# +# + InsertSection "Containers" +# +################################################################################# +# + # Test : CONT-8004 + # Description : Query running Solaris zones + if [ -x /usr/sbin/zoneadm ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + Register --test-no CONT-8004 --os Solaris --weight L --network NO --description "Query running Solaris zones" + if [ ${SKIPTEST} -eq 0 ]; then + logtext "Test: query zoneadm to list all running zones" + FIND=`/usr/sbin/zoneadm list -p | awk -F: '{ if ($2!="global") print $0 }'` + if [ ! "${FIND}" = "" ]; then + N=0 + for I in ${FIND}; do + N=`expr ${N} + 1` + ZONEID=`echo ${I} | cut -d ':' -f1` + ZONENAME=`echo ${I} | cut -d ':' -f2` + logtext "Result: found zone ${ZONENAME} (running)" + report "solaris_running_zone[]=${ZONENAME} [id:${ZONEID}]" + done + logtext "Result: total of ${N} running zones" + Display --indent 2 --text "- Checking Solaris Zones" --result "FOUND ${N} zones" --color GREEN + else + logtext "Result: no running zones found" + Display --indent 2 --text "- Checking Solaris Zones" --result NONE --color WHITE + fi + fi +# +################################################################################# +# + # Test : CONT-1906 + # Description : Query running Xen zones + #if [ -x /usr/bin/xm ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + #Register --test-no CONT-1906 --weight L --network NO --description "Query Xen guests" + #if [ ${SKIPTEST} -eq 0 ]; then + # Show Xen guests + #FIND=`xm list | awk '$1 != "Name|Domain-0" {print $1","$2}'` + #for I in ${FIND}; do + #XENGUESTNAME=`echo ${I} | cut -d ':' -f1` + #XENGUESTID=`echo ${I} | cut -d ':' -f2` + #logtext "Result: found Xen guest ${XENGUESTNAME} (ID: ${XENGUESTID})" + #done + #fi +# +################################################################################# +# + # Test : CONT-8102 + # Description : Checking Docker daemon status and basic information for later tests + Register --test-no CONT-8102 --weight L --network NO --description "Checking Docker status and information" + if [ ${SKIPTEST} -eq 0 ]; then + IsRunning "docker -d" + if [ ${RUNNING} -eq 1 ]; then + logtext "Result: found Docker daemon running" + report "docker_daemon_running=1" + DOCKER_DAEMON_RUNNING=1 + Display --indent 4 --text "- Docker" + Display --indent 6 --text "- Docker daemon" --result RUNNING --color GREEN + fi + fi +# +################################################################################# +# + # Test : CONT-8104 + # Description : Checking Docker info for any warnings + # Notes : Hardening points are awarded, as usually warnings are the result of missing controls to restrict boundaries like memory + if [ ! "${DOCKERBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + Register --test-no CONT-8104 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking Docker info for any warnings" + if [ ${SKIPTEST} -eq 0 ]; then + COUNT=0 + logtext "Test: Check for any warnings" + FIND=`${DOCKERBINARY} info 2>&1 | grep "^WARNING:" | cut -d " " -f 2- | sed 's/ /:space:/g'` + if [ ! "${FIND}" = "" ]; then + logtext "Result: found warning(s) in output" + for I in ${FIND}; do + J=`echo ${I} | sed 's/:space:/ /g'` + logtext "Output: ${J}" + COUNT=`expr ${COUNT} + 1` + done + Display --indent 8 --text "- Docker info output (warnings)" --result "${COUNT}" --color RED + ReportSuggestion "${TEST_NO}" "Run 'docker info' to see warnings applicable to Docker daemon" + AddHP 3 4 + else + logtext "Result: no warnings found from 'docker info' output" + Display --indent 8 --text "- Docker info output (warnings)" --result "NONE" --color GREEN + AddHP 1 1 + fi + fi +# +################################################################################# +# + # Test : CONT-8106 + # Description : Checking Docker containers (basic stats) + # Notes : Hardening points are awarded, if there aren't a lot of stopped containers + if [ ! "${DOCKERBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + Register --test-no CONT-8106 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking Docker info for any warnings" + if [ ${SKIPTEST} -eq 0 ]; then + Display --indent 6 --text "- Containers" + + # Check total of containers + logtext "Test: checking total amount of Docker containers" + DOCKER_CONTAINERS_TOTAL=`${DOCKERBINARY} info 2> /dev/null | grep "^Containers: " | awk '{ print $2 }'` + logtext "Result: docker info shows ${DOCKER_CONTAINERS_TOTAL} containers" + DOCKER_CONTAINERS_TOTAL2=`${DOCKERBINARY} ps -a 2> /dev/null | grep -v "CONTAINER" | wc -l` + logtext "Result: docker ps -a shows ${DOCKER_CONTAINERS_TOTAL2} containers" + if [ ! "${DOCKER_CONTAINERS_TOTAL}" = "${DOCKER_CONTAINERS_TOTAL2}" ]; then + logtext "Result: difference detected, which is unexpected" + ReportSuggestion "${TEST_NO}" "Test output of both 'docker ps -a' and 'docker info', to determine why they report a different amount of containers" + Display --indent 8 --text "- Total containers" --result "UNKNOWN" --color RED + else + Display --indent 8 --text "- Total containers" --result "${DOCKER_CONTAINERS_TOTAL}" --color WHITE + fi + + # Check running instances + DOCKER_CONTAINERS_RUNNING=`${DOCKERBINARY} ps | grep -v "CONTAINER" | wc -l` + Display --indent 8 --text "- Running containers" --result "${DOCKER_CONTAINERS_RUNNING}" --color GREEN + if [ ${DOCKER_CONTAINERS_RUNNING} -gt 0 ]; then + logtext "Result: ${DOCKER_CONTAINERS_RUNNING} containers are currently active" + report "docker_containers_running=${DOCKER_CONTAINERS_RUNNING}" + else + logtext "Result: no active containers" + report "docker_containers_running=0" + fi + + # Check if there aren't too many unused containers on the system + if [ ${DOCKER_CONTAINERS_TOTAL} -gt 0 ]; then + DOCKER_CONTAINERS_UNUSED=`expr ${DOCKER_CONTAINERS_TOTAL} - ${DOCKER_CONTAINERS_RUNNING}` + if [ ${DOCKER_CONTAINERS_UNUSED} -gt 10 ]; then + ReportSuggestion "${TEST_NO}" "More than 10 unused containers found on the system. Clean up old containers by using output of 'docker ps -a' command" + Display --indent 8 --text "- Unused containers" --result "${DOCKER_CONTAINERS_UNUSED}" --color RED + AddHP 0 2 + else + logtext "Result: found ${DOCKER_CONTAINERS_UNUSED} unused containers" + Display --indent 8 --text "- Unused containers" --result "${DOCKER_CONTAINERS_UNUSED}" --color YELLOW + AddHP 1 1 + fi + fi + fi +# +################################################################################# +# + + +wait_for_keypress + +# +#================================================================================ +# Lynis - Copyright 2007-2015, CISOfy - https://cisofy.com