Simple fix for #58 (#61)

* Simple fix for #58 including cleanups and readable readme.md

Signed-off-by: Jeroen Willemsen <jwillemsen@xebia.com>

* processed feedback of @chris-rock

Signed-off-by: Jeroen Willemsen <jwillemsen@xebia.com>

Author: commjoen

.gitignore

@@ -1,2 +1,3 @@
 Gemfile.lock
 .vagrant/
+inspec.lock

README.md

@@ -17,76 +17,60 @@ InSpec is an open-source run-time framework and rule language used to specify co
 
 ### Platform
 
-- Debian 8
-- Ubuntu 16.04
-- CentOS 7
+* Debian 8
+* Ubuntu 16.04
+* CentOS 7
 
 ## Attributes
 
 We use a yml attribute file to steer the configuration, the following options are available:
 
-  * `trusted_user: vagrant`
-    define trusted user to control Docker daemon.
-
-  * `authorization_plugin: authz-broker`
-    define authorization plugin to manage access to Docker daemon.
-
-  * `log_driver: syslog`
-    define preferable way to store logs.
-
-  * `log_opts: /syslog-address/`
-    define Docker daemon log-opts.
-
-  * `registry_cert_path: /etc/docker/certs.d`
-    directory contains various Docker registry directories.
-
-  * `registry_name: /etc/docker/certs.d/registry_hostname:port`
-    directory contain certificate certain Docker registry.
-
-  * `registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crt`
-    certificate file for a certain Docker registry certificate files.
-
-  * `container_user: vagrant`
-    define user within containers.
-
-  * `app_armor_profile: docker-default`
-    define apparmor profile for Docker containers.
-
-  * `selinux_profile: /label\:level\:s0-s0\:c1023/`
-    define SELinux profile for Docker containers.
-
-  * `container_capadd: null`
-    define needed capabilities for containers. example: `container_capadd: NET_ADMIN,SYS_ADMIN`
-
-  * `managable_container_number: 25`
-    keep number of containers on a host to a manageable total.
-
-  * `daemon_tlscacert : /etc/docker/ssl/ca.pem`
-    configure the Trust certs.
-
-  * `daemon_tlscert: /etc/docker/ssl/server_cert.pem`
-    configure the server certificate.
-
-  * `daemon_tlskey: /etc/docker/ssl/server_key.pem`
-    configure the server key.
-
-  * `swarm_mode: inactive`
-    configure the swarm mode.
-
-  * `swarm_max_manager_nodes: 3`
-    configure the maximum number of swarm leaders.
-
-  * `swarm_port: 2377`
-    configure the swarm port.
-
-  * `benchmark_version`
-    to execute also the old controls from previous benchmarks, e.g. set it to 1.12.0 to execute also the tests from cis-benchmark-1.12.0
+* `trusted_user: vagrant`
+  define trusted user to control Docker daemon.
+* `authorization_plugin: authz-broker`
+  define authorization plugin to manage access to Docker daemon.
+* `log_driver: syslog`
+  define preferable way to store logs.
+* `log_opts: /syslog-address/`
+  define Docker daemon log-opts.
+* `registry_cert_path: /etc/docker/certs.d`
+  directory contains various Docker registry directories.
+* `registry_name: /etc/docker/certs.d/registry_hostname:port`
+  directory contain certificate certain Docker registry.
+* `registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crt`
+  certificate file for a certain Docker registry certificate files.
+* `container_user: vagrant`
+  define user within containers.
+* `app_armor_profile: docker-default`
+  define apparmor profile for Docker containers.
+* `selinux_profile: /label\:level\:s0-s0\:c1023/`
+  define SELinux profile for Docker containers.
+* `container_capadd: null`
+  define needed capabilities for containers. example: `container_capadd: NET_ADMIN,SYS_ADMIN`
+* `managable_container_number: 25`
+  keep number of containers on a host to a manageable total.
+* `daemon_tlscacert : /etc/docker/ssl/ca.pem`
+  configure the
+* `daemon_tlscert: /etc/docker/ssl/server_cert.pem`
+  configure the server certificate.
+* `daemon_tlskey: /etc/docker/ssl/server_key.pem`
+  configure the server key.
+* `swarm_mode: inactive`
+  configure the swarm mode.
+* `swarm_max_manager_nodes: 3`
+  configure the maximum number of swarm leaders.
+* `swarm_port: 2377`
+  configure the swarm port.
+* `benchmark_version`
+  to execute also the old controls from previous benchmarks, e.g. set it to 1.12.0 to execute also the tests from cis-benchmark-1.12.0 (which is the default).
+
+These settings can be overriden using an attributes file (e.g. --attrs <attributefile.yml>). See [sample_attributes.yml](sample_attributes.yml) as an example.
 
 ## Usage
 
 InSpec makes it easy to run your tests wherever you need. More options listed here: [InSpec cli](http://inspec.io/docs/reference/cli/)
 
-```
+```sh
 # run profile locally
 $ git clone https://github.com/dev-sec/cis-docker-benchmark
 $ inspec exec cis-docker-benchmark
@@ -111,7 +95,7 @@ inspec supermarket exec dev-sec/cis-docker-benchmark -t ssh://user@hostname --ke
 
 In order to verify individual controls, just provide the control ids to InSpec:
 
-```
+```sh
 inspec exec cis-docker-benchmark --controls 'cis-docker-benchmark-1.4 cis-docker-benchmark-1.5'
 ```
 
@@ -121,7 +105,6 @@ inspec exec cis-docker-benchmark --controls 'cis-docker-benchmark-1.4 cis-docker
 * Dominik Richter [arlimus](https://github.com/arlimus)
 * Christoph Hartmann [chris-rock](https://github.com/chris-rock)
 
-
 ## License and Author
 
 * Author:: Patrick Muench <patrick.muench1111@gmail.com>
@@ -131,7 +114,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+<http://www.apache.org/licenses/LICENSE-2.0>
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,

inspec.yml

@@ -17,6 +17,7 @@ attributes:
     required: true
     description: 'define needed capabilities for containers.'
     type: string
+    default: NET_ADMIN,SYS_ADMIN
   - name: app_armor_profile
     required: false
     description: 'define apparmor profile for Docker containers.'
@@ -41,6 +42,7 @@ attributes:
     required: true
     description: 'to execute also the old controls from previous benchmarks. to execute the controls, define the value as 1.12.0'
     type: string
+    default: 1.12.0
   - name: registry_cert_path
     required: true
     description: 'directory contains various Docker registry directories.'

sample_attributes.yml

@@ -4,9 +4,10 @@ registry_cert_path: /etc/docker/certs.d
 registry_name: /etc/docker/certs.d/registry_hostname:port
 registry_ca_file: /etc/docker/certs.d/registry_hostname:port/ca.crt
 container_user: vagrant
-container_capadd: null
+container_capadd: 'NET_ADMIN'
 authorization_plugin: authz-broker
 log_driver: syslog
 log_opts: /syslog-address/
 app_armor_profile: docker-default
 selinux_profile: /label\:level\:s0-s0\:c1023/
+benchmark_version: 1.12.0