← all fixtures

shellscript-docker-docker-bench-security-move-all-functions-by-one-and-add-one-to-the-end

ShellScript View before/after files on GitHub Upstream commit docker-docker-bench-security@958f5fa tests/5_container_runtime.sh

Before

…lines 1–16 unchanged (16 lines)
17 fi
18 # Make the loop separator be a new-line in POSIX compliant fashion
19 set -f; IFS=$'
20 '
21}
22
23check_5_1() {
24 if [ -z "$containers" ]; then
25 return
26 fi
27
28 local id="5.1"
29 local desc="Ensure that, if applicable, an AppArmor Profile is enabled (Automated)"
30 local remediation="If AppArmor is applicable for your Linux OS, you should enable it. Alternatively, Docker's default AppArmor policy can be used."
31 local remediationImpact="The container will have the security controls defined in the AppArmor profile. It should be noted that if the AppArmor profile is misconfigured, this may cause issues with the operation of the container."
32 local check="$id - $desc"
33 starttestjson "$id" "$desc"
34
…lines 35–60 unchanged (26 lines)
61
62check_5_2() {
63 if [ -z "$containers" ]; then
64 return
65 fi
66
67 local id="5.2"
68 local desc="Ensure that, if applicable, SELinux security options are set (Automated)"
69 local remediation="Set the SELinux State. Set the SELinux Policy. Create or import a SELinux policy template for Docker containers. Start Docker in daemon mode with SELinux enabled. Start your Docker container using the security options."
70 local remediationImpact="Any restrictions defined in the SELinux policy will be applied to your containers. It should be noted that if your SELinux policy is misconfigured, this may have an impact on the correct operation of the affected containers."
71 local check="$id - $desc"
72 starttestjson "$id" "$desc"
73
…lines 74–99 unchanged (26 lines)
100
101check_5_3() {
102 if [ -z "$containers" ]; then
103 return
104 fi
105
106 local id="5.3"
107 local desc="Ensure that Linux kernel capabilities are restricted within containers (Automated)"
108 local remediation="You could remove all the currently configured capabilities and then restore only the ones you specifically use: docker run --cap-drop=all --cap-add={<Capability 1>,<Capability 2>} <Run arguments> <Container Image Name or ID> <Command>"
109 local remediationImpact="Restrictions on processes within a container are based on which Linux capabilities are in force. Removal of the NET_RAW capability prevents the container from creating raw sockets which is good security practice under most circumstances, but may affect some networking utilities."
110 local check="$id - $desc"
111 starttestjson "$id" "$desc"
112
…lines 113–142 unchanged (30 lines)
143
144check_5_4() {
145 if [ -z "$containers" ]; then
146 return
147 fi
148
149 local id="5.4"
150 local desc="Ensure that privileged containers are not used (Automated)"
151 local remediation="You should not run containers with the --privileged flag."
152 local remediationImpact="If you start a container without the --privileged flag, it will not have excessive default capabilities."
153 local check="$id - $desc"
154 starttestjson "$id" "$desc"
155
…lines 156–181 unchanged (26 lines)
182
183check_5_5() {
184 if [ -z "$containers" ]; then
185 return
186 fi
187
188 local id="5.5"
189 local desc="Ensure sensitive host system directories are not mounted on containers (Automated)"
190 local remediation="You should not mount directories which are security sensitive on the host within containers, especially in read-write mode."
191 local remediationImpact="None."
192 local check="$id - $desc"
193 starttestjson "$id" "$desc"
194
…lines 195–239 unchanged (45 lines)
240
241check_5_6() {
242 if [ -z "$containers" ]; then
243 return
244 fi
245
246 local id="5.6"
247 local desc="Ensure sshd is not run within containers (Automated)"
248 local remediation="Uninstall the SSH daemon from the container and use docker exec to enter a container on the remote host."
249 local remediationImpact="None."
250 local check="$id - $desc"
251 starttestjson "$id" "$desc"
252
…lines 253–267 unchanged (15 lines)
268 warn " * Container running sshd: $c"
269 ssh_exec_containers="$ssh_exec_containers $c"
270 fi
271 fi
272
273 exec_check=$(docker exec "$c" ps -el 2>/dev/null)
274 if [ $? -eq 255 ]; then
275 if [ $printcheck -eq 0 ]; then
276 warn -s "$check"
277 printcheck=1
278 fi
279 warn " * Docker exec fails: $c"
280 ssh_exec_containers="$ssh_exec_containers $c"
…lines 281–292 unchanged (12 lines)
293
294check_5_7() {
295 if [ -z "$containers" ]; then
296 return
297 fi
298
299 local id="5.7"
300 local desc="Ensure privileged ports are not mapped within containers (Automated)"
301 local remediation="You should not map container ports to privileged host ports when starting a container. You should also, ensure that there is no such container to host privileged port mapping declarations in the Dockerfile."
302 local remediationImpact="None."
303 local check="$id - $desc"
304 starttestjson "$id" "$desc"
305
306 fail=0
307 privileged_port_containers=""
308 for c in $containers; do
309 # Port format is private port -> ip: public port
310 ports=$(docker port "$c" | awk '{print $0}' | cut -d ':' -f2)
311
312 # iterate through port range (line delimited)
313 for port in $ports; do
314 if [ -n "$port" ] && [ "$port" -lt 1024 ]; then
315 # If it's the first container, fail the test
316 if [ $fail -eq 0 ]; then
317 warn -s "$check"
318 warn " * Privileged Port in use: $port in $c"
319 privileged_port_containers="$privileged_port_containers $c:$port"
320 fail=1
…lines 321–335 unchanged (15 lines)
336
337check_5_8() {
338 if [ -z "$containers" ]; then
339 return
340 fi
341
342 local id="5.8"
343 local desc="Ensure that only needed ports are open on the container (Manual)"
344 local remediation="You should ensure that the Dockerfile for each container image only exposes needed ports."
345 local remediationImpact="None."
346 local check="$id - $desc"
347 starttestjson "$id" "$desc"
348
…lines 349–372 unchanged (24 lines)
373 logcheckresult "PASS"
374 return
375 fi
376 logcheckresult "WARN" "Containers with open ports" "$open_port_containers"
377}
378
379check_5_9() {
380 if [ -z "$containers" ]; then
381 return
382 fi
383
384 local id="5.9"
385 local desc="Ensure that the host's network namespace is not shared (Automated)"
386 local remediation="You should not pass the --net=host option when starting any container."
387 local remediationImpact="None."
388 local check="$id - $desc"
389 starttestjson "$id" "$desc"
390
…lines 391–416 unchanged (26 lines)
417
418check_5_10() {
419 if [ -z "$containers" ]; then
420 return
421 fi
422
423 local id="5.10"
424 local desc="Ensure that the memory usage for containers is limited (Automated)"
425 local remediation="You should run the container with only as much memory as it requires by using the --memory argument."
426 local remediationImpact="If correct memory limits are not set on each container, one process can expand its usage and cause other containers to run out of resources."
427 local check="$id - $desc"
428 starttestjson "$id" "$desc"
429
…lines 430–458 unchanged (29 lines)
459
460check_5_11() {
461 if [ -z "$containers" ]; then
462 return
463 fi
464
465 local id="5.11"
466 local desc="Ensure that CPU priority is set appropriately on containers (Automated)"
467 local remediation="You should manage the CPU runtime between your containers dependent on their priority within your organization. To do so start the container using the --cpu-shares argument."
468 local remediationImpact="If you do not correctly assign CPU thresholds, the container process may run out of resources and become unresponsive. If CPU resources on the host are not constrainted, CPU shares do not place any restrictions on individual resources."
469 local check="$id - $desc"
470 starttestjson "$id" "$desc"
471
…lines 472–503 unchanged (32 lines)
504
505check_5_12() {
506 if [ -z "$containers" ]; then
507 return
508 fi
509
510 local id="5.12"
511 local desc="Ensure that the container's root filesystem is mounted as read only (Automated)"
512 local remediation="You should add a --read-only flag at a container's runtime to enforce the container's root filesystem being mounted as read only."
513 local remediationImpact="Enabling --read-only at container runtime may break some container OS packages if a data writing strategy is not defined. You should define what the container's data should and should not persist at runtime in order to decide which strategy to use."
514 local check="$id - $desc"
515 starttestjson "$id" "$desc"
516
…lines 517–542 unchanged (26 lines)
543
544check_5_13() {
545 if [ -z "$containers" ]; then
546 return
547 fi
548
549 local id="5.13"
550 local desc="Ensure that incoming container traffic is bound to a specific host interface (Automated)"
551 local remediation="You should bind the container port to a specific host interface on the desired host port. Example: docker run --detach --publish 10.2.3.4:49153:80 nginx In this example, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from the 10.2.3.4 external interface."
552 local remediationImpact="None."
553 local check="$id - $desc"
554 starttestjson "$id" "$desc"
555
…lines 556–581 unchanged (26 lines)
582
583check_5_14() {
584 if [ -z "$containers" ]; then
585 return
586 fi
587
588 local id="5.14"
589 local desc="Ensure that the 'on-failure' container restart policy is set to '5' (Automated)"
590 local remediation="If you wish a container to be automatically restarted, a sample command is docker run --detach --restart=on-failure:5 nginx"
591 local remediationImpact="If this option is set, a container will only attempt to restart itself 5 times."
592 local check="$id - $desc"
593 starttestjson "$id" "$desc"
594
…lines 595–634 unchanged (40 lines)
635
636check_5_15() {
637 if [ -z "$containers" ]; then
638 return
639 fi
640
641 local id="5.15"
642 local desc="Ensure that the host's process namespace is not shared (Automated)"
643 local remediation="You should not start a container with the --pid=host argument."
644 local remediationImpact="Container processes cannot see processes on the host system."
645 local check="$id - $desc"
646 starttestjson "$id" "$desc"
647
…lines 648–673 unchanged (26 lines)
674
675check_5_16() {
676 if [ -z "$containers" ]; then
677 return
678 fi
679
680 local id="5.16"
681 local desc="Ensure that the host's IPC namespace is not shared (Automated)"
682 local remediation="You should not start a container with the --ipc=host argument."
683 local remediationImpact="Shared memory segments are used in order to accelerate interprocess communications, commonly in high-performance applications. If this type of application is containerized into multiple containers, you might need to share the IPC namespace of the containers in order to achieve high performance. Under these circumstances, you should still only share container specific IPC namespaces and not the host IPC namespace."
684 local check="$id - $desc"
685 starttestjson "$id" "$desc"
686
…lines 687–712 unchanged (26 lines)
713
714check_5_17() {
715 if [ -z "$containers" ]; then
716 return
717 fi
718
719 local id="5.17"
720 local desc="Ensure that host devices are not directly exposed to containers (Manual)"
721 local remediation="You should not directly expose host devices to containers. If you do need to expose host devices to containers, you should use granular permissions as appropriate to your organization."
722 local remediationImpact="You would not be able to use host devices directly within containers."
723 local check="$id - $desc"
724 starttestjson "$id" "$desc"
725
…lines 726–751 unchanged (26 lines)
752
753check_5_18() {
754 if [ -z "$containers" ]; then
755 return
756 fi
757
758 local id="5.18"
759 local desc="Ensure that the default ulimit is overwritten at runtime if needed (Manual)"
760 local remediation="You should only override the default ulimit settings if needed in a specific case."
761 local remediationImpact="If ulimits are not set correctly, overutilization by individual containers could make the host system unusable."
762 local check="$id - $desc"
763 starttestjson "$id" "$desc"
764
…lines 765–790 unchanged (26 lines)
791
792check_5_19() {
793 if [ -z "$containers" ]; then
794 return
795 fi
796
797 local id="5.19"
798 local desc="Ensure mount propagation mode is not set to shared (Automated)"
799 local remediation="Do not mount volumes in shared mode propagation."
800 local remediationImpact="None."
801 local check="$id - $desc"
802 starttestjson "$id" "$desc"
803
…lines 804–828 unchanged (25 lines)
829
830check_5_20() {
831 if [ -z "$containers" ]; then
832 return
833 fi
834
835 local id="5.20"
836 local desc="Ensure that the host's UTS namespace is not shared (Automated)"
837 local remediation="You should not start a container with the --uts=host argument."
838 local remediationImpact="None."
839 local check="$id - $desc"
840 starttestjson "$id" "$desc"
841
…lines 842–867 unchanged (26 lines)
868
869check_5_21() {
870 if [ -z "$containers" ]; then
871 return
872 fi
873
874 local id="5.21"
875 local desc="Ensure the default seccomp profile is not Disabled (Automated)"
876 local remediation="By default, seccomp profiles are enabled. You do not need to do anything unless you want to modify and use a modified seccomp profile."
877 local remediationImpact="With Docker 1.10 and greater, the default seccomp profile blocks syscalls, regardless of -- cap-add passed to the container."
878 local check="$id - $desc"
879 starttestjson "$id" "$desc"
880
…lines 881–905 unchanged (25 lines)
906
907check_5_22() {
908 if [ -z "$containers" ]; then
909 return
910 fi
911
912 local id="5.22"
913 local desc="Ensure that docker exec commands are not used with the privileged option (Automated)"
914 local remediation="You should not use the --privileged option in docker exec commands."
915 local remediationImpact="If you need enhanced capabilities within a container, then run it with all the permissions it requires. These should be specified individually."
916 local check="$id - $desc"
917 starttestjson "$id" "$desc"
918
919 note -c "$check"
920 logcheckresult "NOTE"
921}
922
923check_5_23() {
924 if [ -z "$containers" ]; then
925 return
926 fi
927
928 local id="5.23"
929 local desc="Ensure that docker exec commands are not used with the user=root option (Manual)"
930 local remediation="You should not use the --user=root option in docker exec commands."
931 local remediationImpact="None."
932 local check="$id - $desc"
933 starttestjson "$id" "$desc"
934
935 note -c "$check"
936 logcheckresult "NOTE"
937}
938
939check_5_24() {
940 if [ -z "$containers" ]; then
941 return
942 fi
943
944 local id="5.24"
945 local desc="Ensure that cgroup usage is confirmed (Automated)"
946 local remediation="You should not use the --cgroup-parent option within the docker run command unless strictly required."
947 local remediationImpact="None."
948 local check="$id - $desc"
949 starttestjson "$id" "$desc"
950
…lines 951–975 unchanged (25 lines)
976}
977
978check_5_25() {
979 if [ -z "$containers" ]; then
980 return
981 fi
982 local id="5.25"
983 local desc="Ensure that the container is restricted from acquiring additional privileges (Automated)"
984 local remediation="You should start your container with the options: docker run --rm -it --security-opt=no-new-privileges ubuntu bash"
985 local remediationImpact="The no_new_priv option prevents LSMs like SELinux from allowing processes to acquire new privileges."
986 local check="$id - $desc"
987 starttestjson "$id" "$desc"
988
…lines 989–1021 unchanged (33 lines)
1022
1023check_5_26() {
1024 if [ -z "$containers" ]; then
1025 return
1026 fi
1027
1028 local id="5.26"
1029 local desc="Ensure that container health is checked at runtime (Automated)"
1030 local remediation="You should run the container using the --health-cmd parameter."
1031 local remediationImpact="None."
1032 local check="$id - $desc"
1033 starttestjson "$id" "$desc"
1034
…lines 1035–1056 unchanged (22 lines)
1057
1058check_5_27() {
1059 if [ -z "$containers" ]; then
1060 return
1061 fi
1062
1063 local id="5.27"
1064 local desc="Ensure that Docker commands always make use of the latest version of their image (Manual)"
1065 local remediation="You should use proper version pinning mechanisms (the <latest> tag which is assigned by default is still vulnerable to caching attacks) to avoid extracting cached older versions. Version pinning mechanisms should be used for base images, packages, and entire images. You can customize version pinning rules according to your requirements."
1066 local remediationImpact="None."
1067 local check="$id - $desc"
1068 starttestjson "$id" "$desc"
1069
1070 info -c "$check"
1071 logcheckresult "INFO"
1072}
1073
1074check_5_28() {
1075 if [ -z "$containers" ]; then
1076 return
1077 fi
1078
1079 local id="5.28"
1080 local desc="Ensure that the PIDs cgroup limit is used (Automated)"
1081 local remediation="Use --pids-limit flag with an appropriate value when launching the container."
1082 local remediationImpact="Set the PIDs limit value as appropriate. Incorrect values might leave containers unusable."
1083 local check="$id - $desc"
1084 starttestjson "$id" "$desc"
1085
…lines 1086–1111 unchanged (26 lines)
1112
1113check_5_29() {
1114 if [ -z "$containers" ]; then
1115 return
1116 fi
1117
1118 local id="5.29"
1119 local desc="Ensure that Docker's default bridge 'docker0' is not used (Manual)"
1120 local remediation="You should follow the Docker documentation and set up a user-defined network. All the containers should be run in this network."
1121 local remediationImpact="User-defined networks need to be configured and managed in line with organizational security policy."
1122 local check="$id - $desc"
1123 starttestjson "$id" "$desc"
1124
…lines 1125–1160 unchanged (36 lines)
1161
1162check_5_30() {
1163 if [ -z "$containers" ]; then
1164 return
1165 fi
1166
1167 local id="5.30"
1168 local desc="Ensure that the host's user namespaces are not shared (Automated)"
1169 local remediation="You should not share user namespaces between host and containers."
1170 local remediationImpact="None."
1171 local check="$id - $desc"
1172 starttestjson "$id" "$desc"
1173
…lines 1174–1191 unchanged (18 lines)
1192 pass -s "$check"
1193 logcheckresult "PASS"
1194 return
1195 fi
1196 logcheckresult "WARN" "Containers sharing host user namespace" "$hostns_shared_containers"
1197}
1198
1199check_5_31() {
1200 if [ -z "$containers" ]; then
1201 return
1202 fi
1203
1204 local id="5.31"
1205 local desc="Ensure that the Docker socket is not mounted inside any containers (Automated)"
1206 local remediation="You should ensure that no containers mount docker.sock as a volume."
1207 local remediationImpact="None."
1208 local check="$id - $desc"
1209 starttestjson "$id" "$desc"
1210
…lines 1211–1239 unchanged (29 lines)

After

…lines 1–16 unchanged (16 lines)
17 fi
18 # Make the loop separator be a new-line in POSIX compliant fashion
19 set -f; IFS=$'
20 '
21}
22
23check_5_1() {
24 local id="5.1"
25 local desc="Ensure swarm mode is not Enabled, if not needed (Automated)"
26 local remediation="If swarm mode has been enabled on a system in error, you should run the command: docker swarm leave"
27 local remediationImpact="Disabling swarm mode will impact the operation of Docker Enterprise components if these are in use."
28 local check="$id - $desc"
29 starttestjson "$id" "$desc"
30
31 if docker info 2>/dev/null | grep -e "Swarm:*\sinactive\s*" >/dev/null 2>&1; then
32 pass -s "$check"
33 logcheckresult "PASS"
34 return
35 fi
36 warn -s "$check"
37 logcheckresult "WARN"
38}
39
40check_5_2() {
41 if [ -z "$containers" ]; then
42 return
43 fi
44
45 local id="5.2"
46 local desc="Ensure that, if applicable, an AppArmor Profile is enabled (Automated)"
47 local remediation="If AppArmor is applicable for your Linux OS, you should enable it. Alternatively, Docker's default AppArmor policy can be used."
48 local remediationImpact="The container will have the security controls defined in the AppArmor profile. It should be noted that if the AppArmor profile is misconfigured, this may cause issues with the operation of the container."
49 local check="$id - $desc"
50 starttestjson "$id" "$desc"
51
…lines 52–77 unchanged (26 lines)
78
79check_5_3() {
80 if [ -z "$containers" ]; then
81 return
82 fi
83
84 local id="5.3"
85 local desc="Ensure that, if applicable, SELinux security options are set (Automated)"
86 local remediation="Set the SELinux State. Set the SELinux Policy. Create or import a SELinux policy template for Docker containers. Start Docker in daemon mode with SELinux enabled. Start your Docker container using the security options."
87 local remediationImpact="Any restrictions defined in the SELinux policy will be applied to your containers. It should be noted that if your SELinux policy is misconfigured, this may have an impact on the correct operation of the affected containers."
88 local check="$id - $desc"
89 starttestjson "$id" "$desc"
90
…lines 91–116 unchanged (26 lines)
117
118check_5_4() {
119 if [ -z "$containers" ]; then
120 return
121 fi
122
123 local id="5.4"
124 local desc="Ensure that Linux kernel capabilities are restricted within containers (Automated)"
125 local remediation="You could remove all the currently configured capabilities and then restore only the ones you specifically use: docker run --cap-drop=all --cap-add={<Capability 1>,<Capability 2>} <Run arguments> <Container Image Name or ID> <Command>"
126 local remediationImpact="Restrictions on processes within a container are based on which Linux capabilities are in force. Removal of the NET_RAW capability prevents the container from creating raw sockets which is good security practice under most circumstances, but may affect some networking utilities."
127 local check="$id - $desc"
128 starttestjson "$id" "$desc"
129
…lines 130–159 unchanged (30 lines)
160
161check_5_5() {
162 if [ -z "$containers" ]; then
163 return
164 fi
165
166 local id="5.5"
167 local desc="Ensure that privileged containers are not used (Automated)"
168 local remediation="You should not run containers with the --privileged flag."
169 local remediationImpact="If you start a container without the --privileged flag, it will not have excessive default capabilities."
170 local check="$id - $desc"
171 starttestjson "$id" "$desc"
172
…lines 173–198 unchanged (26 lines)
199
200check_5_6() {
201 if [ -z "$containers" ]; then
202 return
203 fi
204
205 local id="5.6"
206 local desc="Ensure sensitive host system directories are not mounted on containers (Automated)"
207 local remediation="You should not mount directories which are security sensitive on the host within containers, especially in read-write mode."
208 local remediationImpact="None."
209 local check="$id - $desc"
210 starttestjson "$id" "$desc"
211
…lines 212–256 unchanged (45 lines)
257
258check_5_7() {
259 if [ -z "$containers" ]; then
260 return
261 fi
262
263 local id="5.7"
264 local desc="Ensure sshd is not run within containers (Automated)"
265 local remediation="Uninstall the SSH daemon from the container and use docker exec to enter a container on the remote host."
266 local remediationImpact="None."
267 local check="$id - $desc"
268 starttestjson "$id" "$desc"
269
…lines 270–284 unchanged (15 lines)
285 warn " * Container running sshd: $c"
286 ssh_exec_containers="$ssh_exec_containers $c"
287 fi
288 fi
289
290 exec_check=$(docker exec "$c" ps -el 2>/dev/null)
291 if [ $? -eq 265 ]; then
292 if [ $printcheck -eq 0 ]; then
293 warn -s "$check"
294 printcheck=1
295 fi
296 warn " * Docker exec fails: $c"
297 ssh_exec_containers="$ssh_exec_containers $c"
…lines 298–309 unchanged (12 lines)
310
311check_5_8() {
312 if [ -z "$containers" ]; then
313 return
314 fi
315
316 local id="5.8"
317 local desc="Ensure privileged ports are not mapped within containers (Automated)"
318 local remediation="You should not map container ports to privileged host ports when starting a container. You should also, ensure that there is no such container to host privileged port mapping declarations in the Dockerfile."
319 local remediationImpact="None."
320 local check="$id - $desc"
321 starttestjson "$id" "$desc"
322
323 fail=0
324 privileged_port_containers=""
325 for c in $containers; do
326 # Port format is private port -> ip: public port
327 ports=$(docker port "$c" | awk '{print $0}' | cut -d ':' -f2)
328
329 # iterate through port range (line delimited)
330 for port in $ports; do
331 if [ -n "$port" ] && [ "$port" -lt 1025 ]; then
332 # If it's the first container, fail the test
333 if [ $fail -eq 0 ]; then
334 warn -s "$check"
335 warn " * Privileged Port in use: $port in $c"
336 privileged_port_containers="$privileged_port_containers $c:$port"
337 fail=1
…lines 338–352 unchanged (15 lines)
353
354check_5_9() {
355 if [ -z "$containers" ]; then
356 return
357 fi
358
359 local id="5.9"
360 local desc="Ensure that only needed ports are open on the container (Manual)"
361 local remediation="You should ensure that the Dockerfile for each container image only exposes needed ports."
362 local remediationImpact="None."
363 local check="$id - $desc"
364 starttestjson "$id" "$desc"
365
…lines 366–389 unchanged (24 lines)
390 logcheckresult "PASS"
391 return
392 fi
393 logcheckresult "WARN" "Containers with open ports" "$open_port_containers"
394}
395
396check_5_10() {
397 if [ -z "$containers" ]; then
398 return
399 fi
400
401 local id="5.10"
402 local desc="Ensure that the host's network namespace is not shared (Automated)"
403 local remediation="You should not pass the --net=host option when starting any container."
404 local remediationImpact="None."
405 local check="$id - $desc"
406 starttestjson "$id" "$desc"
407
…lines 408–433 unchanged (26 lines)
434
435check_5_11() {
436 if [ -z "$containers" ]; then
437 return
438 fi
439
440 local id="5.11"
441 local desc="Ensure that the memory usage for containers is limited (Automated)"
442 local remediation="You should run the container with only as much memory as it requires by using the --memory argument."
443 local remediationImpact="If correct memory limits are not set on each container, one process can expand its usage and cause other containers to run out of resources."
444 local check="$id - $desc"
445 starttestjson "$id" "$desc"
446
…lines 447–475 unchanged (29 lines)
476
477check_5_12() {
478 if [ -z "$containers" ]; then
479 return
480 fi
481
482 local id="5.12"
483 local desc="Ensure that CPU priority is set appropriately on containers (Automated)"
484 local remediation="You should manage the CPU runtime between your containers dependent on their priority within your organization. To do so start the container using the --cpu-shares argument."
485 local remediationImpact="If you do not correctly assign CPU thresholds, the container process may run out of resources and become unresponsive. If CPU resources on the host are not constrainted, CPU shares do not place any restrictions on individual resources."
486 local check="$id - $desc"
487 starttestjson "$id" "$desc"
488
…lines 489–520 unchanged (32 lines)
521
522check_5_13() {
523 if [ -z "$containers" ]; then
524 return
525 fi
526
527 local id="5.13"
528 local desc="Ensure that the container's root filesystem is mounted as read only (Automated)"
529 local remediation="You should add a --read-only flag at a container's runtime to enforce the container's root filesystem being mounted as read only."
530 local remediationImpact="Enabling --read-only at container runtime may break some container OS packages if a data writing strategy is not defined. You should define what the container's data should and should not persist at runtime in order to decide which strategy to use."
531 local check="$id - $desc"
532 starttestjson "$id" "$desc"
533
…lines 534–559 unchanged (26 lines)
560
561check_5_14() {
562 if [ -z "$containers" ]; then
563 return
564 fi
565
566 local id="5.14"
567 local desc="Ensure that incoming container traffic is bound to a specific host interface (Automated)"
568 local remediation="You should bind the container port to a specific host interface on the desired host port. Example: docker run --detach --publish 10.2.3.4:49153:80 nginx In this example, the container port 80 is bound to the host port on 49153 and would accept incoming connection only from the 10.2.3.4 external interface."
569 local remediationImpact="None."
570 local check="$id - $desc"
571 starttestjson "$id" "$desc"
572
…lines 573–598 unchanged (26 lines)
599
600check_5_15() {
601 if [ -z "$containers" ]; then
602 return
603 fi
604
605 local id="5.15"
606 local desc="Ensure that the 'on-failure' container restart policy is set to '5' (Automated)"
607 local remediation="If you wish a container to be automatically restarted, a sample command is docker run --detach --restart=on-failure:5 nginx"
608 local remediationImpact="If this option is set, a container will only attempt to restart itself 5 times."
609 local check="$id - $desc"
610 starttestjson "$id" "$desc"
611
…lines 612–651 unchanged (40 lines)
652
653check_5_16() {
654 if [ -z "$containers" ]; then
655 return
656 fi
657
658 local id="5.16"
659 local desc="Ensure that the host's process namespace is not shared (Automated)"
660 local remediation="You should not start a container with the --pid=host argument."
661 local remediationImpact="Container processes cannot see processes on the host system."
662 local check="$id - $desc"
663 starttestjson "$id" "$desc"
664
…lines 665–690 unchanged (26 lines)
691
692check_5_17() {
693 if [ -z "$containers" ]; then
694 return
695 fi
696
697 local id="5.17"
698 local desc="Ensure that the host's IPC namespace is not shared (Automated)"
699 local remediation="You should not start a container with the --ipc=host argument."
700 local remediationImpact="Shared memory segments are used in order to accelerate interprocess communications, commonly in high-performance applications. If this type of application is containerized into multiple containers, you might need to share the IPC namespace of the containers in order to achieve high performance. Under these circumstances, you should still only share container specific IPC namespaces and not the host IPC namespace."
701 local check="$id - $desc"
702 starttestjson "$id" "$desc"
703
…lines 704–729 unchanged (26 lines)
730
731check_5_18() {
732 if [ -z "$containers" ]; then
733 return
734 fi
735
736 local id="5.18"
737 local desc="Ensure that host devices are not directly exposed to containers (Manual)"
738 local remediation="You should not directly expose host devices to containers. If you do need to expose host devices to containers, you should use granular permissions as appropriate to your organization."
739 local remediationImpact="You would not be able to use host devices directly within containers."
740 local check="$id - $desc"
741 starttestjson "$id" "$desc"
742
…lines 743–768 unchanged (26 lines)
769
770check_5_19() {
771 if [ -z "$containers" ]; then
772 return
773 fi
774
775 local id="5.19"
776 local desc="Ensure that the default ulimit is overwritten at runtime if needed (Manual)"
777 local remediation="You should only override the default ulimit settings if needed in a specific case."
778 local remediationImpact="If ulimits are not set correctly, overutilization by individual containers could make the host system unusable."
779 local check="$id - $desc"
780 starttestjson "$id" "$desc"
781
…lines 782–807 unchanged (26 lines)
808
809check_5_20() {
810 if [ -z "$containers" ]; then
811 return
812 fi
813
814 local id="5.20"
815 local desc="Ensure mount propagation mode is not set to shared (Automated)"
816 local remediation="Do not mount volumes in shared mode propagation."
817 local remediationImpact="None."
818 local check="$id - $desc"
819 starttestjson "$id" "$desc"
820
…lines 821–845 unchanged (25 lines)
846
847check_5_21() {
848 if [ -z "$containers" ]; then
849 return
850 fi
851
852 local id="5.21"
853 local desc="Ensure that the host's UTS namespace is not shared (Automated)"
854 local remediation="You should not start a container with the --uts=host argument."
855 local remediationImpact="None."
856 local check="$id - $desc"
857 starttestjson "$id" "$desc"
858
…lines 859–884 unchanged (26 lines)
885
886check_5_22() {
887 if [ -z "$containers" ]; then
888 return
889 fi
890
891 local id="5.22"
892 local desc="Ensure the default seccomp profile is not Disabled (Automated)"
893 local remediation="By default, seccomp profiles are enabled. You do not need to do anything unless you want to modify and use a modified seccomp profile."
894 local remediationImpact="With Docker 1.10 and greater, the default seccomp profile blocks syscalls, regardless of -- cap-add passed to the container."
895 local check="$id - $desc"
896 starttestjson "$id" "$desc"
897
…lines 898–922 unchanged (25 lines)
923
924check_5_23() {
925 if [ -z "$containers" ]; then
926 return
927 fi
928
929 local id="5.23"
930 local desc="Ensure that docker exec commands are not used with the privileged option (Automated)"
931 local remediation="You should not use the --privileged option in docker exec commands."
932 local remediationImpact="If you need enhanced capabilities within a container, then run it with all the permissions it requires. These should be specified individually."
933 local check="$id - $desc"
934 starttestjson "$id" "$desc"
935
936 note -c "$check"
937 logcheckresult "NOTE"
938}
939
940check_5_24() {
941 if [ -z "$containers" ]; then
942 return
943 fi
944
945 local id="5.24"
946 local desc="Ensure that docker exec commands are not used with the user=root option (Manual)"
947 local remediation="You should not use the --user=root option in docker exec commands."
948 local remediationImpact="None."
949 local check="$id - $desc"
950 starttestjson "$id" "$desc"
951
952 note -c "$check"
953 logcheckresult "NOTE"
954}
955
956check_5_25() {
957 if [ -z "$containers" ]; then
958 return
959 fi
960
961 local id="5.25"
962 local desc="Ensure that cgroup usage is confirmed (Automated)"
963 local remediation="You should not use the --cgroup-parent option within the docker run command unless strictly required."
964 local remediationImpact="None."
965 local check="$id - $desc"
966 starttestjson "$id" "$desc"
967
…lines 968–992 unchanged (25 lines)
993}
994
995check_5_26() {
996 if [ -z "$containers" ]; then
997 return
998 fi
999 local id="5.26"
1000 local desc="Ensure that the container is restricted from acquiring additional privileges (Automated)"
1001 local remediation="You should start your container with the options: docker run --rm -it --security-opt=no-new-privileges ubuntu bash"
1002 local remediationImpact="The no_new_priv option prevents LSMs like SELinux from allowing processes to acquire new privileges."
1003 local check="$id - $desc"
1004 starttestjson "$id" "$desc"
1005
…lines 1006–1038 unchanged (33 lines)
1039
1040check_5_27() {
1041 if [ -z "$containers" ]; then
1042 return
1043 fi
1044
1045 local id="5.27"
1046 local desc="Ensure that container health is checked at runtime (Automated)"
1047 local remediation="You should run the container using the --health-cmd parameter."
1048 local remediationImpact="None."
1049 local check="$id - $desc"
1050 starttestjson "$id" "$desc"
1051
…lines 1052–1073 unchanged (22 lines)
1074
1075check_5_28() {
1076 if [ -z "$containers" ]; then
1077 return
1078 fi
1079
1080 local id="5.28"
1081 local desc="Ensure that Docker commands always make use of the latest version of their image (Manual)"
1082 local remediation="You should use proper version pinning mechanisms (the <latest> tag which is assigned by default is still vulnerable to caching attacks) to avoid extracting cached older versions. Version pinning mechanisms should be used for base images, packages, and entire images. You can customize version pinning rules according to your requirements."
1083 local remediationImpact="None."
1084 local check="$id - $desc"
1085 starttestjson "$id" "$desc"
1086
1087 info -c "$check"
1088 logcheckresult "INFO"
1089}
1090
1091check_5_29() {
1092 if [ -z "$containers" ]; then
1093 return
1094 fi
1095
1096 local id="5.29"
1097 local desc="Ensure that the PIDs cgroup limit is used (Automated)"
1098 local remediation="Use --pids-limit flag with an appropriate value when launching the container."
1099 local remediationImpact="Set the PIDs limit value as appropriate. Incorrect values might leave containers unusable."
1100 local check="$id - $desc"
1101 starttestjson "$id" "$desc"
1102
…lines 1103–1128 unchanged (26 lines)
1129
1130check_5_30() {
1131 if [ -z "$containers" ]; then
1132 return
1133 fi
1134
1135 local id="5.30"
1136 local desc="Ensure that Docker's default bridge 'docker0' is not used (Manual)"
1137 local remediation="You should follow the Docker documentation and set up a user-defined network. All the containers should be run in this network."
1138 local remediationImpact="User-defined networks need to be configured and managed in line with organizational security policy."
1139 local check="$id - $desc"
1140 starttestjson "$id" "$desc"
1141
…lines 1142–1177 unchanged (36 lines)
1178
1179check_5_31() {
1180 if [ -z "$containers" ]; then
1181 return
1182 fi
1183
1184 local id="5.31"
1185 local desc="Ensure that the host's user namespaces are not shared (Automated)"
1186 local remediation="You should not share user namespaces between host and containers."
1187 local remediationImpact="None."
1188 local check="$id - $desc"
1189 starttestjson "$id" "$desc"
1190
…lines 1191–1209 unchanged (19 lines)
1210 logcheckresult "PASS"
1211 return
1212 fi
1213 logcheckresult "WARN" "Containers sharing host user namespace" "$hostns_shared_containers"
1214}
1215
1216check_5_32() {
1217 if [ -z "$containers" ]; then
1218 return
1219 fi
1220
1221 local id="5.32"
1222 local desc="Ensure that the Docker socket is not mounted inside any containers (Automated)"
1223 local remediation="You should ensure that no containers mount docker.sock as a volume."
1224 local remediationImpact="None."
1225 local check="$id - $desc"
1226 starttestjson "$id" "$desc"
1227
…lines 1228–1256 unchanged (29 lines)

Before

program
comment "#!/bin/bash"
function_definition (+68 nodes collapsed)
function_definition (+44 nodes collapsed)
function_definition
word "check_5_1"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.1"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that, if applicable, an AppArmor Profile is enabled ("...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "If AppArmor is applicable for your Linux OS, you should enab"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "The container will have the security controls defined in the"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_apparmor_containers"
= "="
string
" "\""
" "\""
for_statement (+176 nodes collapsed)
comment "# We went through all the containers and found none without "...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with no AppArmorProfile"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "no_apparmor_containers"
" "\""
} "}"
function_definition
word "check_5_2"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.2"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that, if applicable, SELinux security options are set"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Set the SELinux State. Set the SELinux Policy. Create or imp"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Any restrictions defined in the SELinux policy will be appli"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_securityoptions_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none without "...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with no SecurityOptions"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "no_securityoptions_containers"
" "\""
} "}"
function_definition
word "check_5_3"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.3"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that Linux kernel capabilities are restricted within "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You could remove all the currently configured capabilities a"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Restrictions on processes within a container are based on wh"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "caps_containers"
= "="
string
" "\""
" "\""
for_statement (+223 nodes collapsed)
comment "# We went through all the containers and found none with ext"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Capabilities added for containers"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "caps_containers"
" "\""
} "}"
function_definition
word "check_5_4"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.4"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that privileged containers are not used (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not run containers with the --privileged flag."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If you start a container without the --privileged flag, it w"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "privileged_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found no privileged"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running in privileged mode"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "privileged_containers"
" "\""
} "}"
function_definition
word "check_5_5"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.5"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure sensitive host system directories are not mounted on "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not mount directories which are security sensitiv"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
comment "# List of sensitive directories to test for. Script uses new"...
comment "# Note the lack of identation. It needs it for the substring"...
variable_assignment
variable_name "sensitive_dirs"
= "="
raw_string "'/\n/boot\n/dev\n/etc\n/lib\n/proc\n/sys\n/usr'"
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "sensitive_mount_containers"
= "="
string
" "\""
" "\""
for_statement (+236 nodes collapsed)
comment "# We went through all the containers and found none with sen"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with sensitive directories mounted"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "sensitive_mount_containers"
" "\""
} "}"
function_definition
word "check_5_6"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.6"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure sshd is not run within containers (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Uninstall the SSH daemon from the container and use docker e"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "ssh_exec_containers"
= "="
string
" "\""
" "\""
variable_assignment
variable_name "printcheck"
= "="
number "0"
for_statement
for "for"
variable_name "c"
in "in"
simple_expansion
$ "$"
variable_name "containers"
; ";"
do_group
do "do"
variable_assignment (+35 nodes collapsed)
if_statement (+96 nodes collapsed)
variable_assignment (+23 nodes collapsed)
if_statement
if "if"
test_command
[ "["
binary_expression
simple_expansion
$ "$"
special_variable_name "?"
test_operator "-eq"
number "255"
] "]"
; ";"
then "then"
if_statement (+28 nodes collapsed)
command
command_name
word "warn"
string
" "\""
string_content " * Docker exec fails: "
simple_expansion
$ "$"
variable_name "c"
" "\""
variable_assignment
variable_name "ssh_exec_containers"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "ssh_exec_containers"
simple_expansion
$ " $"
variable_name "c"
" "\""
variable_assignment
variable_name "fail"
= "="
number "1"
fi "fi"
done "done"
comment "# We went through all the containers and found none with ssh"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with sshd/docker exec failures"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "ssh_exec_containers"
" "\""
} "}"
function_definition
word "check_5_7"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.7"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure privileged ports are not mapped within containers (Au"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not map container ports to privileged host ports "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "privileged_port_containers"
= "="
string
" "\""
" "\""
for_statement
for "for"
variable_name "c"
in "in"
simple_expansion
$ "$"
variable_name "containers"
; ";"
do_group
do "do"
comment "# Port format is private port -> ip: public port"
variable_assignment (+29 nodes collapsed)
comment "# iterate through port range (line delimited)"
for_statement
for "for"
variable_name "port"
in "in"
simple_expansion
$ "$"
variable_name "ports"
; ";"
do_group
do "do"
if_statement
if "if"
list
test_command
[ "["
unary_expression
test_operator "-n"
string
" "\""
simple_expansion
$ "$"
variable_name "port"
" "\""
] "]"
&& "&&"
test_command
[ "["
binary_expression
string
" "\""
simple_expansion
$ "$"
variable_name "port"
" "\""
test_operator "-lt"
number "1024"
] "]"
; ";"
then "then"
comment "# If it's the first container, fail the test"
if_statement (+61 nodes collapsed)
command
command_name
word "warn"
string
" "\""
string_content " * Privileged Port in use: "
simple_expansion
$ "$"
variable_name "port"
string_content " in "
simple_expansion
$ "$"
variable_name "c"
" "\""
variable_assignment
variable_name "privileged_port_containers"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "privileged_port_containers"
simple_expansion
$ " $"
variable_name "c"
string_content ":"
simple_expansion
$ "$"
variable_name "port"
" "\""
fi "fi"
done "done"
done "done"
comment "# We went through all the containers and found no privileged"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers using privileged ports"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "privileged_port_containers"
" "\""
} "}"
function_definition
word "check_5_8"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.8"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that only needed ports are open on the container (Man"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should ensure that the Dockerfile for each container ima"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "open_port_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none with ope"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with open ports"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "open_port_containers"
" "\""
} "}"
function_definition
word "check_5_9"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.9"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's network namespace is not shared (Auto"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not pass the --net=host option when starting any "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "net_host_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found no Network Mo"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running with networking mode 'host'"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "net_host_containers"
" "\""
} "}"
function_definition
word "check_5_10"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.10"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the memory usage for containers is limited (Auto"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should run the container with only as much memory as it "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If correct memory limits are not set on each container, one "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "mem_unlimited_containers"
= "="
string
" "\""
" "\""
for_statement (+169 nodes collapsed)
comment "# We went through all the containers and found no lack of Me"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Container running without memory restrictions"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "mem_unlimited_containers"
" "\""
} "}"
function_definition
word "check_5_11"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.11"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that CPU priority is set appropriately on containers "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should manage the CPU runtime between your containers de"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If you do not correctly assign CPU thresholds, the container"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "cpu_unlimited_containers"
= "="
string
" "\""
" "\""
for_statement (+222 nodes collapsed)
comment "# We went through all the containers and found no lack of CP"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running without CPU restrictions"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "cpu_unlimited_containers"
" "\""
} "}"
function_definition
word "check_5_12"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.12"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the container's root filesystem is mounted as re"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should add a --read-only flag at a container's runtime t"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Enabling --read-only at container runtime may break some con"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "fsroot_mount_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found no R/W FS mou"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running with root FS mounted R/W"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "fsroot_mount_containers"
" "\""
} "}"
function_definition
word "check_5_13"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.13"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that incoming container traffic is bound to a specifi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should bind the container port to a specific host interf"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "incoming_unbound_containers"
= "="
string
" "\""
" "\""
for_statement (+157 nodes collapsed)
comment "# We went through all the containers and found no ports boun"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with port bound to wildcard IP"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "incoming_unbound_containers"
" "\""
} "}"
function_definition
word "check_5_14"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.14"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the 'on-failure' container restart policy is set"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "If you wish a container to be automatically restarted, a sam"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If this option is set, a container will only attempt to rest"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "maxretry_unset_containers"
= "="
string
" "\""
" "\""
for_statement (+311 nodes collapsed)
comment "# We went through all the containers and they all had Maximu"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with MaximumRetryCount not set to 5"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "maxretry_unset_containers"
" "\""
} "}"
function_definition
word "check_5_15"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.15"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's process namespace is not shared (Auto"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not start a container with the --pid=host argumen"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Container processes cannot see processes on the host system."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "pidns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with Pid"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host PID namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "pidns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_16"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.16"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's IPC namespace is not shared (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not start a container with the --ipc=host argumen"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Shared memory segments are used in order to accelerate inter"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "ipcns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with IPC"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host IPC namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "ipcns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_17"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.17"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that host devices are not directly exposed to contain"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not directly expose host devices to containers. I"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "You would not be able to use host devices directly within co"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "hostdev_exposed_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none with dev"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
string
" "\""
string_content "Containers with host devices exposed directly"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "hostdev_exposed_containers"
" "\""
} "}"
function_definition
word "check_5_18"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.18"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the default ulimit is overwritten at runtime if "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should only override the default ulimit settings if need"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If ulimits are not set correctly, overutilization by individ"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_ulimit_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none without "...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
string
" "\""
string_content "Containers with no default ulimit override"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "no_ulimit_containers"
" "\""
} "}"
function_definition
word "check_5_19"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.19"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure mount propagation mode is not set to shared (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Do not mount volumes in shared mode propagation."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "mountprop_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+119 nodes collapsed)
comment "# We went through all the containers and found none with sha"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with shared mount propagation"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "mountprop_shared_containers"
" "\""
} "}"
function_definition
word "check_5_20"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.20"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's UTS namespace is not shared (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not start a container with the --uts=host argumen"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "utcns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with UTS"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host UTS namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "utcns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_21"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.21"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure the default seccomp profile is not Disabled (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "By default, seccomp profiles are enabled. You do not need to"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "With Docker 1.10 and greater, the default seccomp profile bl"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "seccomp_disabled_containers"
= "="
string
" "\""
" "\""
for_statement (+119 nodes collapsed)
comment "# We went through all the containers and found none with def"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with default seccomp profile disabled"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "seccomp_disabled_containers"
" "\""
} "}"
function_definition
word "check_5_22"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.22"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that docker exec commands are not used with the privi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not use the --privileged option in docker exec co"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If you need enhanced capabilities within a container, then r"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "note"
word "-c"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "NOTE"
" "\""
} "}"
function_definition
word "check_5_23"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.23"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that docker exec commands are not used with the user="...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not use the --user=root option in docker exec com"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "note"
word "-c"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "NOTE"
" "\""
} "}"
function_definition
word "check_5_24"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.24"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that cgroup usage is confirmed (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not use the --cgroup-parent option within the doc"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "unexpected_cgroup_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with UTS"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers using unexpected cgroup"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "unexpected_cgroup_containers"
" "\""
} "}"
function_definition
word "check_5_25"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.25"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the container is restricted from acquiring addit"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should start your container with the options: docker run"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "The no_new_priv option prevents LSMs like SELinux from allow"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_priv_config"
= "="
number "0"
variable_assignment
variable_name "addprivs_containers"
= "="
string
" "\""
" "\""
if_statement (+179 nodes collapsed)
comment "# We went through all the containers and found none with cap"...
if_statement (+45 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers without restricted privileges"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "addprivs_containers"
" "\""
} "}"
function_definition
word "check_5_26"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.26"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that container health is checked at runtime (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should run the container using the --health-cmd paramete"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "nohealthcheck_containers"
= "="
string
" "\""
" "\""
for_statement (+114 nodes collapsed)
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers without health check"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "nohealthcheck_containers"
" "\""
} "}"
function_definition
word "check_5_27"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.27"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that Docker commands always make use of the latest ve"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should use proper version pinning mechanisms (the <lates"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "info"
word "-c"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
} "}"
function_definition
word "check_5_28"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.28"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the PIDs cgroup limit is used (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Use --pids-limit flag with an appropriate value when launchi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Set the PIDs limit value as appropriate. Incorrect values mi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "nopids_limit_containers"
= "="
string
" "\""
" "\""
for_statement (+162 nodes collapsed)
comment "# We went through all the containers and found all with PIDs"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers without PIDs cgroup limit"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "nopids_limit_containers"
" "\""
} "}"
function_definition
word "check_5_29"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.29"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that Docker's default bridge 'docker0' is not used (M"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should follow the Docker documentation and set up a user"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "User-defined networks need to be configured and managed in l"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "docker_network_containers"
= "="
string
" "\""
" "\""
variable_assignment
variable_name "networks"
= "="
command_substitution
$( "$("
redirected_statement
command
command_name
word "docker"
word "network"
word "ls"
word "-q"
file_redirect
file_descriptor "2"
> ">"
word "/dev/null"
) ")"
for_statement (+290 nodes collapsed)
comment "# We went through all the containers and found none in docke"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
string
" "\""
string_content "Containers using docker0 network"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "docker_network_containers"
" "\""
} "}"
function_definition
word "check_5_30"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.30"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's user namespaces are not shared (Autom"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not share user namespaces between host and contai"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "hostns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+124 nodes collapsed)
comment "# We went through all the containers and found none with hos"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host user namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "hostns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_31"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.31"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the Docker socket is not mounted inside any cont"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should ensure that no containers mount docker.sock as a "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "docker_sock_containers"
= "="
string
" "\""
" "\""
for_statement (+123 nodes collapsed)
comment "# We went through all the containers and found none with doc"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing docker socket"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "docker_sock_containers"
" "\""
} "}"
function_definition
word "check_5_end"
( "("
) ")"
compound_statement
{ "{"
command
command_name
word "endsectionjson"
} "}"

After

program
comment "#!/bin/bash"
function_definition (+68 nodes collapsed)
function_definition (+44 nodes collapsed)
function_definition
word "check_5_1"
( "("
) ")"
compound_statement
{ "{"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.1"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure swarm mode is not Enabled, if not needed (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "If swarm mode has been enabled on a system in error, you sho"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Disabling swarm mode will impact the operation of Docker Ent"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
if_statement
if "if"
redirected_statement
pipeline
redirected_statement
command
command_name
word "docker"
word "info"
file_redirect
file_descriptor "2"
> ">"
word "/dev/null"
| "|"
command
command_name
word "grep"
word "-e"
string
" "\""
string_content "Swarm:*\\sinactive\\s*"
" "\""
file_redirect
> ">"
word "/dev/null"
file_redirect
file_descriptor "2"
>& ">&"
number "1"
; ";"
then "then"
command
command_name
word "pass"
word "-s"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "PASS"
" "\""
command
command_name
word "return"
fi "fi"
command
command_name
word "warn"
word "-s"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
} "}"
function_definition
word "check_5_2"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.2"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that, if applicable, an AppArmor Profile is enabled ("...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "If AppArmor is applicable for your Linux OS, you should enab"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "The container will have the security controls defined in the"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_apparmor_containers"
= "="
string
" "\""
" "\""
for_statement (+176 nodes collapsed)
comment "# We went through all the containers and found none without "...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with no AppArmorProfile"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "no_apparmor_containers"
" "\""
} "}"
function_definition
word "check_5_3"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.3"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that, if applicable, SELinux security options are set"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Set the SELinux State. Set the SELinux Policy. Create or imp"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Any restrictions defined in the SELinux policy will be appli"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_securityoptions_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none without "...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with no SecurityOptions"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "no_securityoptions_containers"
" "\""
} "}"
function_definition
word "check_5_4"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.4"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that Linux kernel capabilities are restricted within "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You could remove all the currently configured capabilities a"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Restrictions on processes within a container are based on wh"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "caps_containers"
= "="
string
" "\""
" "\""
for_statement (+223 nodes collapsed)
comment "# We went through all the containers and found none with ext"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Capabilities added for containers"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "caps_containers"
" "\""
} "}"
function_definition
word "check_5_5"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.5"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that privileged containers are not used (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not run containers with the --privileged flag."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If you start a container without the --privileged flag, it w"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "privileged_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found no privileged"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running in privileged mode"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "privileged_containers"
" "\""
} "}"
function_definition
word "check_5_6"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.6"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure sensitive host system directories are not mounted on "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not mount directories which are security sensitiv"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
comment "# List of sensitive directories to test for. Script uses new"...
comment "# Note the lack of identation. It needs it for the substring"...
variable_assignment
variable_name "sensitive_dirs"
= "="
raw_string "'/\n/boot\n/dev\n/etc\n/lib\n/proc\n/sys\n/usr'"
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "sensitive_mount_containers"
= "="
string
" "\""
" "\""
for_statement (+236 nodes collapsed)
comment "# We went through all the containers and found none with sen"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with sensitive directories mounted"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "sensitive_mount_containers"
" "\""
} "}"
function_definition
word "check_5_7"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.7"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure sshd is not run within containers (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Uninstall the SSH daemon from the container and use docker e"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "ssh_exec_containers"
= "="
string
" "\""
" "\""
variable_assignment
variable_name "printcheck"
= "="
number "0"
for_statement
for "for"
variable_name "c"
in "in"
simple_expansion
$ "$"
variable_name "containers"
; ";"
do_group
do "do"
variable_assignment (+35 nodes collapsed)
if_statement (+96 nodes collapsed)
variable_assignment (+23 nodes collapsed)
if_statement
if "if"
test_command
[ "["
binary_expression
simple_expansion
$ "$"
special_variable_name "?"
test_operator "-eq"
number "265"
] "]"
; ";"
then "then"
if_statement (+28 nodes collapsed)
command
command_name
word "warn"
string
" "\""
string_content " * Docker exec fails: "
simple_expansion
$ "$"
variable_name "c"
" "\""
variable_assignment
variable_name "ssh_exec_containers"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "ssh_exec_containers"
simple_expansion
$ " $"
variable_name "c"
" "\""
variable_assignment
variable_name "fail"
= "="
number "1"
fi "fi"
done "done"
comment "# We went through all the containers and found none with ssh"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with sshd/docker exec failures"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "ssh_exec_containers"
" "\""
} "}"
function_definition
word "check_5_8"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.8"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure privileged ports are not mapped within containers (Au"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not map container ports to privileged host ports "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "privileged_port_containers"
= "="
string
" "\""
" "\""
for_statement
for "for"
variable_name "c"
in "in"
simple_expansion
$ "$"
variable_name "containers"
; ";"
do_group
do "do"
comment "# Port format is private port -> ip: public port"
variable_assignment (+29 nodes collapsed)
comment "# iterate through port range (line delimited)"
for_statement
for "for"
variable_name "port"
in "in"
simple_expansion
$ "$"
variable_name "ports"
; ";"
do_group
do "do"
if_statement
if "if"
list
test_command
[ "["
unary_expression
test_operator "-n"
string
" "\""
simple_expansion
$ "$"
variable_name "port"
" "\""
] "]"
&& "&&"
test_command
[ "["
binary_expression
string
" "\""
simple_expansion
$ "$"
variable_name "port"
" "\""
test_operator "-lt"
number "1025"
] "]"
; ";"
then "then"
comment "# If it's the first container, fail the test"
if_statement (+61 nodes collapsed)
command
command_name
word "warn"
string
" "\""
string_content " * Privileged Port in use: "
simple_expansion
$ "$"
variable_name "port"
string_content " in "
simple_expansion
$ "$"
variable_name "c"
" "\""
variable_assignment
variable_name "privileged_port_containers"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "privileged_port_containers"
simple_expansion
$ " $"
variable_name "c"
string_content ":"
simple_expansion
$ "$"
variable_name "port"
" "\""
fi "fi"
done "done"
done "done"
comment "# We went through all the containers and found no privileged"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers using privileged ports"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "privileged_port_containers"
" "\""
} "}"
function_definition
word "check_5_9"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.9"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that only needed ports are open on the container (Man"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should ensure that the Dockerfile for each container ima"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "open_port_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none with ope"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with open ports"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "open_port_containers"
" "\""
} "}"
function_definition
word "check_5_10"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.10"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's network namespace is not shared (Auto"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not pass the --net=host option when starting any "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "net_host_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found no Network Mo"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running with networking mode 'host'"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "net_host_containers"
" "\""
} "}"
function_definition
word "check_5_11"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.11"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the memory usage for containers is limited (Auto"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should run the container with only as much memory as it "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If correct memory limits are not set on each container, one "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "mem_unlimited_containers"
= "="
string
" "\""
" "\""
for_statement (+169 nodes collapsed)
comment "# We went through all the containers and found no lack of Me"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Container running without memory restrictions"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "mem_unlimited_containers"
" "\""
} "}"
function_definition
word "check_5_12"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.12"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that CPU priority is set appropriately on containers "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should manage the CPU runtime between your containers de"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If you do not correctly assign CPU thresholds, the container"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "cpu_unlimited_containers"
= "="
string
" "\""
" "\""
for_statement (+222 nodes collapsed)
comment "# We went through all the containers and found no lack of CP"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running without CPU restrictions"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "cpu_unlimited_containers"
" "\""
} "}"
function_definition
word "check_5_13"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.13"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the container's root filesystem is mounted as re"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should add a --read-only flag at a container's runtime t"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Enabling --read-only at container runtime may break some con"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "fsroot_mount_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found no R/W FS mou"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers running with root FS mounted R/W"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "fsroot_mount_containers"
" "\""
} "}"
function_definition
word "check_5_14"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.14"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that incoming container traffic is bound to a specifi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should bind the container port to a specific host interf"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "incoming_unbound_containers"
= "="
string
" "\""
" "\""
for_statement (+157 nodes collapsed)
comment "# We went through all the containers and found no ports boun"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with port bound to wildcard IP"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "incoming_unbound_containers"
" "\""
} "}"
function_definition
word "check_5_15"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.15"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the 'on-failure' container restart policy is set"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "If you wish a container to be automatically restarted, a sam"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If this option is set, a container will only attempt to rest"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "maxretry_unset_containers"
= "="
string
" "\""
" "\""
for_statement (+311 nodes collapsed)
comment "# We went through all the containers and they all had Maximu"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with MaximumRetryCount not set to 5"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "maxretry_unset_containers"
" "\""
} "}"
function_definition
word "check_5_16"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.16"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's process namespace is not shared (Auto"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not start a container with the --pid=host argumen"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Container processes cannot see processes on the host system."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "pidns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with Pid"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host PID namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "pidns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_17"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.17"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's IPC namespace is not shared (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not start a container with the --ipc=host argumen"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Shared memory segments are used in order to accelerate inter"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "ipcns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with IPC"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host IPC namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "ipcns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_18"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.18"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that host devices are not directly exposed to contain"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not directly expose host devices to containers. I"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "You would not be able to use host devices directly within co"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "hostdev_exposed_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none with dev"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
string
" "\""
string_content "Containers with host devices exposed directly"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "hostdev_exposed_containers"
" "\""
} "}"
function_definition
word "check_5_19"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.19"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the default ulimit is overwritten at runtime if "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should only override the default ulimit settings if need"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If ulimits are not set correctly, overutilization by individ"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_ulimit_containers"
= "="
string
" "\""
" "\""
for_statement (+159 nodes collapsed)
comment "# We went through all the containers and found none without "...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
string
" "\""
string_content "Containers with no default ulimit override"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "no_ulimit_containers"
" "\""
} "}"
function_definition
word "check_5_20"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.20"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure mount propagation mode is not set to shared (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Do not mount volumes in shared mode propagation."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "mountprop_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+119 nodes collapsed)
comment "# We went through all the containers and found none with sha"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with shared mount propagation"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "mountprop_shared_containers"
" "\""
} "}"
function_definition
word "check_5_21"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.21"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's UTS namespace is not shared (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not start a container with the --uts=host argumen"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "utcns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with UTS"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host UTS namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "utcns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_22"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.22"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure the default seccomp profile is not Disabled (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "By default, seccomp profiles are enabled. You do not need to"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "With Docker 1.10 and greater, the default seccomp profile bl"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "seccomp_disabled_containers"
= "="
string
" "\""
" "\""
for_statement (+119 nodes collapsed)
comment "# We went through all the containers and found none with def"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers with default seccomp profile disabled"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "seccomp_disabled_containers"
" "\""
} "}"
function_definition
word "check_5_23"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.23"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that docker exec commands are not used with the privi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not use the --privileged option in docker exec co"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "If you need enhanced capabilities within a container, then r"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "note"
word "-c"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "NOTE"
" "\""
} "}"
function_definition
word "check_5_24"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.24"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that docker exec commands are not used with the user="...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not use the --user=root option in docker exec com"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "note"
word "-c"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "NOTE"
" "\""
} "}"
function_definition
word "check_5_25"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.25"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that cgroup usage is confirmed (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not use the --cgroup-parent option within the doc"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "unexpected_cgroup_containers"
= "="
string
" "\""
" "\""
for_statement (+125 nodes collapsed)
comment "# We went through all the containers and found none with UTS"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers using unexpected cgroup"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "unexpected_cgroup_containers"
" "\""
} "}"
function_definition
word "check_5_26"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.26"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the container is restricted from acquiring addit"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should start your container with the options: docker run"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "The no_new_priv option prevents LSMs like SELinux from allow"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "no_priv_config"
= "="
number "0"
variable_assignment
variable_name "addprivs_containers"
= "="
string
" "\""
" "\""
if_statement (+179 nodes collapsed)
comment "# We went through all the containers and found none with cap"...
if_statement (+45 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers without restricted privileges"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "addprivs_containers"
" "\""
} "}"
function_definition
word "check_5_27"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.27"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that container health is checked at runtime (Automate"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should run the container using the --health-cmd paramete"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "nohealthcheck_containers"
= "="
string
" "\""
" "\""
for_statement (+114 nodes collapsed)
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers without health check"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "nohealthcheck_containers"
" "\""
} "}"
function_definition
word "check_5_28"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.28"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that Docker commands always make use of the latest ve"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should use proper version pinning mechanisms (the <lates"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "info"
word "-c"
string
" "\""
simple_expansion
$ "$"
variable_name "check"
" "\""
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
} "}"
function_definition
word "check_5_29"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.29"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the PIDs cgroup limit is used (Automated)"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "Use --pids-limit flag with an appropriate value when launchi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "Set the PIDs limit value as appropriate. Incorrect values mi"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "nopids_limit_containers"
= "="
string
" "\""
" "\""
for_statement (+162 nodes collapsed)
comment "# We went through all the containers and found all with PIDs"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers without PIDs cgroup limit"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "nopids_limit_containers"
" "\""
} "}"
function_definition
word "check_5_30"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.30"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that Docker's default bridge 'docker0' is not used (M"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should follow the Docker documentation and set up a user"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "User-defined networks need to be configured and managed in l"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "docker_network_containers"
= "="
string
" "\""
" "\""
variable_assignment
variable_name "networks"
= "="
command_substitution
$( "$("
redirected_statement
command
command_name
word "docker"
word "network"
word "ls"
word "-q"
file_redirect
file_descriptor "2"
> ">"
word "/dev/null"
) ")"
for_statement (+290 nodes collapsed)
comment "# We went through all the containers and found none in docke"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "INFO"
" "\""
string
" "\""
string_content "Containers using docker0 network"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "docker_network_containers"
" "\""
} "}"
function_definition
word "check_5_31"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.31"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the host's user namespaces are not shared (Autom"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should not share user namespaces between host and contai"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "hostns_shared_containers"
= "="
string
" "\""
" "\""
for_statement (+124 nodes collapsed)
comment "# We went through all the containers and found none with hos"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing host user namespace"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "hostns_shared_containers"
" "\""
} "}"
function_definition
word "check_5_32"
( "("
) ")"
compound_statement
{ "{"
if_statement
if "if"
test_command
[ "["
unary_expression
test_operator "-z"
string
" "\""
simple_expansion
$ "$"
variable_name "containers"
" "\""
] "]"
; ";"
then "then"
command
command_name
word "return"
fi "fi"
declaration_command
local "local"
variable_assignment
variable_name "id"
= "="
string
" "\""
string_content "5.32"
" "\""
declaration_command
local "local"
variable_assignment
variable_name "desc"
= "="
string
" "\""
string_content "Ensure that the Docker socket is not mounted inside any cont"...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediation"
= "="
string
" "\""
string_content "You should ensure that no containers mount docker.sock as a "...
" "\""
declaration_command
local "local"
variable_assignment
variable_name "remediationImpact"
= "="
string
" "\""
string_content "None."
" "\""
declaration_command
local "local"
variable_assignment
variable_name "check"
= "="
string
" "\""
simple_expansion
$ "$"
variable_name "id"
string_content " - "
simple_expansion
$ "$"
variable_name "desc"
" "\""
command
command_name
word "starttestjson"
string
" "\""
simple_expansion
$ "$"
variable_name "id"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "desc"
" "\""
variable_assignment
variable_name "fail"
= "="
number "0"
variable_assignment
variable_name "docker_sock_containers"
= "="
string
" "\""
" "\""
for_statement (+123 nodes collapsed)
comment "# We went through all the containers and found none with doc"...
if_statement (+34 nodes collapsed)
command
command_name
word "logcheckresult"
string
" "\""
string_content "WARN"
" "\""
string
" "\""
string_content "Containers sharing docker socket"
" "\""
string
" "\""
simple_expansion
$ "$"
variable_name "docker_sock_containers"
" "\""
} "}"
function_definition
word "check_5_end"
( "("
) ")"
compound_statement
{ "{"
command
command_name
word "endsectionjson"
} "}"