Skip to content

Commit 9077da9

Browse files
chris-rockchris-rock
committed
use unified attributes
Signed-off-by: Christoph Hartmann <chris@lollyrock.com>
1 parent 4eedbef commit 9077da9

File tree

7 files changed

+125
-120
lines changed

7 files changed

+125
-120
lines changed

‎controls/container_images.rb‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,10 @@
2323
title 'Container Images and Build File'
2424

2525
# attributes
26-
CONTAINER_USER = attribute(
27-
'container_user',
28-
description: 'define user within containers.',
29-
default: 'ubuntu'
30-
)
26+
CONTAINER_USER = attribute('container_user')
3127

3228
# check if docker exists
33-
only_if do
29+
only_if('docker not found') do
3430
command('docker').exist?
3531
end
3632

‎controls/container_runtime.rb‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -23,25 +23,12 @@
2323
title 'Container Runtime'
2424

2525
# attributes
26-
CONTAINER_CAPADD = attribute(
27-
'container_capadd',
28-
description: 'define needed capabilities for containers.'
29-
)
30-
31-
APP_ARMOR_PROFILE = attribute(
32-
'app_armor_profile',
33-
description: 'define apparmor profile for Docker containers.',
34-
default: 'docker-default'
35-
)
36-
37-
SELINUX_PROFILE = attribute(
38-
'selinux_profile',
39-
description: 'define SELinux profile for Docker containers.',
40-
default: /label\:level\:s0-s0\:c1023/
41-
)
26+
CONTAINER_CAPADD = attribute('container_capadd')
27+
APP_ARMOR_PROFILE = attribute('app_armor_profile')
28+
SELINUX_PROFILE = attribute('selinux_profile')
4229

4330
# check if docker exists
44-
only_if do
31+
only_if('docker not found') do
4532
command('docker').exist?
4633
end
4734

‎controls/docker_daemon_configuration.rb‎

Lines changed: 11 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -23,68 +23,19 @@
2323
title 'Docker Daemon Configuration'
2424

2525
# attributes
26-
DAEMON_TLSCACERT = attribute(
27-
'daemon_tlscacert',
28-
description: 'Trust certs signed only by this CA',
29-
default: '/etc/docker/ssl/ca.pem'
30-
)
31-
32-
DAEMON_TLSCERT = attribute(
33-
'daemon_tlscert',
34-
description: 'Path to TLS certificate file',
35-
default: '/etc/docker/ssl/server_cert.pem'
36-
)
37-
38-
DAEMON_TLSKEY = attribute(
39-
'daemon_tlskey',
40-
description: 'Path to TLS key file',
41-
default: '/etc/docker/ssl/server_key.pem'
42-
)
43-
44-
AUTHORIZATION_PLUGIN = attribute(
45-
'authorization_plugin',
46-
description: 'define authorization plugin to manage access to Docker daemon.',
47-
default: 'authz-broker'
48-
)
49-
50-
LOG_DRIVER = attribute(
51-
'log_driver',
52-
description: 'define preferable way to store logs.',
53-
default: 'syslog'
54-
)
55-
56-
LOG_OPTS = attribute(
57-
'log_opts',
58-
description: 'define Docker daemon log-opts.',
59-
default: /syslog-address/
60-
)
61-
62-
SWARM_MODE = attribute(
63-
'swarm_mode',
64-
description: 'define the swarm mode, `active` or `inactive`',
65-
default: 'inactive'
66-
)
67-
68-
SWARM_MAX_MANAGER_NODES = attribute(
69-
'swarm_max_manager_nodes',
70-
description: 'number of manager nodes in a swarm',
71-
default: 3
72-
)
73-
74-
SWARM_PORT = attribute(
75-
'swarm_port',
76-
description: 'port of the swarm node',
77-
default: 2377
78-
)
79-
80-
SECCOMP_DEFAULT_PROFILE = attribute(
81-
'seccomp_default_profile',
82-
description: 'define the default seccomp profile',
83-
default: 'default'
84-
)
26+
DAEMON_TLSCACERT = attribute('daemon_tlscacert')
27+
DAEMON_TLSCERT = attribute('daemon_tlscert')
28+
DAEMON_TLSKEY = attribute('daemon_tlskey')
29+
AUTHORIZATION_PLUGIN = attribute('authorization_plugin')
30+
LOG_DRIVER = attribute('log_driver')
31+
LOG_OPTS = attribute('log_opts')
32+
SWARM_MODE = attribute('swarm_mode')
33+
SWARM_MAX_MANAGER_NODES = attribute('swarm_max_manager_nodes')
34+
SWARM_PORT = attribute('swarm_port')
35+
SECCOMP_DEFAULT_PROFILE = attribute('seccomp_default_profile')
8536

8637
# check if docker exists
87-
only_if do
38+
only_if('docker not found') do
8839
command('docker').exist?
8940
end
9041

‎controls/docker_daemon_configuration_files.rb‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -23,26 +23,12 @@
2323
title 'Docker Daemon Configuration Files'
2424

2525
# attributes
26-
REGISTRY_CERT_PATH = attribute(
27-
'registry_cert_path',
28-
description: 'directory contains various Docker registry directories.',
29-
default: '/etc/docker/certs.d'
30-
)
31-
32-
REGISTRY_NAME = attribute(
33-
'registry_name',
34-
description: 'directory contain certificate certain Docker registry.',
35-
default: '/etc/docker/certs.d/registry_hostname:port'
36-
)
37-
38-
REGISTRY_CA_FILE = attribute(
39-
'registry_ca_file',
40-
description: 'certificate file for a certain Docker registry certificate files.',
41-
default: '/etc/docker/certs.d/registry_hostname:port/ca.crt'
42-
)
26+
REGISTRY_CERT_PATH = attribute('registry_cert_path')
27+
REGISTRY_NAME = attribute('registry_name')
28+
REGISTRY_CA_FILE = attribute('registry_ca_file')
4329

4430
# check if docker exists
45-
only_if do
31+
only_if('docker not found') do
4632
command('docker').exist?
4733
end
4834

‎controls/docker_security_operations.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
title 'Docker Security Operations'
2424

2525
# check if docker exists
26-
only_if do
26+
only_if('docker not found') do
2727
command('docker').exist?
2828
end
2929

‎controls/host_configuration.rb‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -22,26 +22,12 @@
2222

2323
title 'Host Configuration'
2424

25-
TRUSTED_USER = attribute(
26-
'trusted_user',
27-
description: 'define trusted user to control Docker daemon.',
28-
default: 'vagrant'
29-
)
30-
31-
MANAGEABLE_CONTAINER_NUMBER = attribute(
32-
'managable_container_number',
33-
description: 'keep number of containers on a host to a manageable total.',
34-
default: 25
35-
)
36-
37-
BENCHMARK_VERSION = attribute(
38-
'benchmark_version',
39-
description: 'to execute also the old controls from previous benchmarks. to execute the controls, define the value as 1.12.0',
40-
default: ''
41-
)
25+
TRUSTED_USER = attribute('trusted_user')
26+
MANAGEABLE_CONTAINER_NUMBER = attribute('managable_container_number')
27+
BENCHMARK_VERSION = attribute('benchmark_version')
4228

4329
# check if docker exists
44-
only_if do
30+
only_if('docker not found') do
4531
command('docker').exist?
4632
end
4733

‎inspec.yml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,102 @@ copyright_email: hello@dev-sec.io
66
license: Apache-2.0
77
summary: An InSpec Compliance Profile for the CIS Docker Benchmark
88
version: 2.1.0
9+
attributes:
10+
- name: container_user
11+
required: false
12+
description: 'define user within containers.'
13+
default: 'ubuntu'
14+
type: string
15+
- name: container_capadd
16+
required: true
17+
description: 'define needed capabilities for containers.'
18+
type: string
19+
- name: app_armor_profile
20+
required: false
21+
description: 'define apparmor profile for Docker containers.'
22+
default: 'docker-default'
23+
type: string
24+
- name: selinux_profile
25+
required: false
26+
description: 'define SELinux profile for Docker containers.'
27+
default: label:level:s0-s0:c1023
28+
type: string
29+
- name: trusted_user
30+
required: false
31+
description: 'define trusted user to control Docker daemon.'
32+
default: vagrant
33+
type: string
34+
- name: managable_container_number
35+
required: true
36+
description: 'keep number of containers on a host to a manageable total.'
37+
default: 25
38+
type: numeric
39+
- name: benchmark_version
40+
required: true
41+
description: 'to execute also the old controls from previous benchmarks. to execute the controls, define the value as 1.12.0'
42+
type: string
43+
- name: registry_cert_path
44+
required: true
45+
description: 'directory contains various Docker registry directories.'
46+
default: '/etc/docker/certs.d'
47+
type: string
48+
- name: registry_name
49+
required: true
50+
description: 'directory contain certificate certain Docker registry.'
51+
default: '/etc/docker/certs.d/registry_hostname:port'
52+
type: string
53+
- name: registry_ca_file
54+
required: false
55+
description: 'directory contain certificate certain Docker registry.'
56+
default: '/etc/docker/certs.d/registry_hostname:port/ca.crt'
57+
type: string
58+
- name: daemon_tlscacert
59+
required: false
60+
description: 'Trust certs signed only by this CA'
61+
default: '/etc/docker/ssl/ca.pem'
62+
type: string
63+
- name: daemon_tlscert
64+
required: false
65+
description: 'Path to TLS certificate file'
66+
default: '/etc/docker/ssl/server_cert.pem'
67+
type: string
68+
- name: daemon_tlskey
69+
required: false
70+
description: 'Path to TLS key file'
71+
default: '/etc/docker/ssl/server_key.pem'
72+
type: string
73+
- name: authorization_plugin
74+
required: false
75+
description: 'define authorization plugin to manage access to Docker daemon.'
76+
default: 'authz-broker'
77+
type: string
78+
- name: log_driver
79+
required: false
80+
description: 'define preferable way to store logs.'
81+
default: 'syslog'
82+
type: string
83+
- name: log_opts
84+
required: false
85+
description: 'define Docker daemon log-opts.'
86+
default: syslog-address
87+
type: string
88+
- name: swarm_mode
89+
required: false
90+
description: 'define the swarm mode, `active` or `inactive`'
91+
default: inactive
92+
type: string
93+
- name: swarm_max_manager_nodes
94+
required: false
95+
description: 'number of manager nodes in a swarm'
96+
default: 3
97+
type: numeric
98+
- name: swarm_port
99+
required: false
100+
description: 'port of the swarm node'
101+
default: 2377
102+
type: numeric
103+
- name: seccomp_default_profile
104+
required: false
105+
description: 'define the default seccomp profile'
106+
default: 'default'
107+
type: string

0 commit comments

Comments
 (0)