|
| 1 | +#!/usr/bin/env bash |
| 2 | + |
| 3 | +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" |
| 4 | +source ${DIR}/.functions.sh || exit 1 |
| 5 | +source ${DIR}/.env.sh || exit 1 |
| 6 | + |
| 7 | +function die() |
| 8 | +{ |
| 9 | + echo "$*" >&2 |
| 10 | + exit 1 |
| 11 | +} |
| 12 | + |
| 13 | +function invalid() |
| 14 | +{ |
| 15 | + echo -e "$*\n" >&2 |
| 16 | + usage |
| 17 | + exit 1 |
| 18 | +} |
| 19 | + |
| 20 | +function usage() |
| 21 | +{ |
| 22 | + echo "oscap-docker -- Tool for SCAP evaluation of Docker images and containers." |
| 23 | + echo |
| 24 | + echo "Compliance scan of Docker image:" |
| 25 | + echo "$ sudo oscap-docker [--oscap=<OSCAP_BINARY>] IMAGE_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]" |
| 26 | + echo |
| 27 | + echo "Compliance scan of Docker container:" |
| 28 | + echo "$ sudo oscap-docker [--oscap=<OSCAP_BINARY>] CONTAINER_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]" |
| 29 | + echo |
| 30 | + echo "See \`man oscap\` to learn more about semantics of OSCAP_ARGUMENT options." |
| 31 | +} |
| 32 | + |
| 33 | +OSCAP_BINARY=oscap |
| 34 | + |
| 35 | +if [ $# -lt 1 ]; then |
| 36 | + invalid "No arguments provided." |
| 37 | +elif [ "$1" == "-h" ] || [ "$1" == "--help" ]; then |
| 38 | + usage |
| 39 | + exit 0 |
| 40 | +elif [[ "$1" == --oscap=* ]] && [ $# -gt 2 ]; then |
| 41 | + OSCAP_BINARY=${1#"--oscap="} |
| 42 | + shift |
| 43 | +elif [ "$#" -gt 1 ]; then |
| 44 | + true |
| 45 | +else |
| 46 | + invalid "Invalid arguments provided." |
| 47 | +fi |
| 48 | + |
| 49 | +if [ "$(id -u)" -ne 0 ]; then |
| 50 | + die "This script cannot run in rootless mode." |
| 51 | +fi |
| 52 | +if grep -q -- "--remediate" <<< "$@"; then |
| 53 | + die "This script does not support '--remediate' option." |
| 54 | +fi |
| 55 | + |
| 56 | +IMAGE_NAME=$(docker image inspect --format "{{.Id}} {{.RepoTags}}" "$1") |
| 57 | + |
| 58 | +# Check if the target of scan is image or container. |
| 59 | +CLEANUP=0 |
| 60 | +if [ -n "$IMAGE_NAME" ]; then |
| 61 | + ID=$(docker create $1 sh) || die "Unable to create a container." |
| 62 | + TARGET="docker-image://$IMAGE_NAME" |
| 63 | + CLEANUP=1 |
| 64 | +else |
| 65 | + die "Target of the scan not found: '$1'." |
| 66 | +fi |
| 67 | + |
| 68 | + |
| 69 | +MOUNT_TMP=$(mktemp -d) |
| 70 | +docker export "$ID" | tar -C "$MOUNT_TMP" -xf - || die "Failed to export container." |
| 71 | + |
| 72 | +DIR="$MOUNT_TMP" |
| 73 | +if [ ! -f "$DIR/run/.containerenv" ]; then |
| 74 | + # ubi8-init image does not create .containerenv when running docker init, but we need to make sure that the file is there |
| 75 | + touch "$DIR/run/.containerenv" |
| 76 | +fi |
| 77 | + |
| 78 | +ls -l $DIR/run/.containerenv |
| 79 | +export OSCAP_CONTAINER_VARS |
| 80 | +OSCAP_CONTAINER_VARS=`docker inspect $ID --format '{{join .Config.Env "\n"}}'` |
| 81 | + |
| 82 | +export OSCAP_PROBE_ROOT |
| 83 | +OSCAP_PROBE_ROOT="$(cd "$DIR" && pwd)" || die "Unable to change current directory to OSCAP_PROBE_ROOT (DIR)." |
| 84 | +export OSCAP_EVALUATION_TARGET="$TARGET" |
| 85 | +shift 1 |
| 86 | + |
| 87 | +#echo_begingroup "OSCAP scan report for $NAMESPACE/$IMAGE" |
| 88 | +$OSCAP_BINARY "$@" | echo |
| 89 | +EXIT_CODE=$? |
| 90 | +#echo_debug "EXIT_CODE:$EXIT_CODE" |
| 91 | +#echo_endgroup |
| 92 | + |
| 93 | +if [ $CLEANUP -eq 1 ]; then |
| 94 | + # docker-rm should handle also unmounting of the container filesystem. |
| 95 | + docker rm "$ID" &> /dev/null || die "Failed to clean up." |
| 96 | + rm -rf "$MOUNT_TMP" |
| 97 | +fi |
| 98 | +exit $EXIT_CODE |
| 99 | + |
0 commit comments