turbot/docker_compliance
GitHub
docker_container_apparmor_profile_enableddocker_container_cgroup_usagedocker_container_cpu_priority_setdocker_container_default_seccomp_profile_disableddocker_container_default_ulimitdocker_container_healthcheck_instructiondocker_container_host_devices_exposeddocker_container_host_ipc_namespace_shareddocker_container_host_network_namespace_shareddocker_container_host_process_namespace_shareddocker_container_host_system_directories_mounteddocker_container_host_user_namespace_shareddocker_container_host_uts_namespace_shareddocker_container_memory_usage_limitdocker_container_mount_propagation_mode_shareddocker_container_no_new_privilegesdocker_container_pid_cgroup_limit_useddocker_container_privilegeddocker_container_restart_policy_on_failuredocker_container_root_filesystem_mounteddocker_info_aufs_storage_driver_unuseddocker_info_centralized_and_remote_logging_configureddocker_info_container_sprawl_avoideddocker_info_custom_seccomp_profile_applieddocker_info_insecure_registries_unuseddocker_info_live_restore_enableddocker_info_swarm_manager_auto_lock_modedocker_info_swarm_minimum_required_manager_nodesdocker_info_swarm_mode_enableddocker_info_swarm_node_cert_expiry_setdocker_info_user_namespace_support_enableddocker_network_traffic_restricted_between_containersexec_auditing_configured_containerd_sockexec_auditing_configured_docker_daemonexec_auditing_configured_docker_serviceexec_auditing_configured_docker_socketexec_auditing_configured_etc_containerd_configexec_auditing_configured_etc_default_dockerexec_auditing_configured_etc_dockerexec_auditing_configured_etc_docker_daemonexec_auditing_configured_etc_sysconfig_dockerexec_auditing_configured_run_containerdexec_auditing_configured_usr_bin_containerdexec_auditing_configured_usr_bin_containerd_shimexec_auditing_configured_usr_bin_containerd_shim_runc_v1exec_auditing_configured_usr_bin_containerd_shim_runc_v2exec_auditing_configured_usr_bin_runcexec_auditing_configured_var_lib_dockerexec_authorization_docker_client_command_enabledexec_base_device_size_changedexec_containers_no_new_privilege_disabledexec_default_ulimit_configuredexec_docker_container_non_root_userexec_docker_container_trust_enabledexec_docker_daemon_run_as_root_userexec_docker_exec_command_no_privilege_optionexec_docker_exec_command_no_user_root_optionexec_docker_iptables_not_setexec_docker_socket_not_mounted_inside_containersexec_logging_level_set_to_infoexec_ownership_root_docker_socketexec_ownership_root_root_daemon_jsonexec_ownership_root_root_docker_containerd_socketexec_ownership_root_root_docker_server_certificateexec_ownership_root_root_docker_server_certificate_keyexec_ownership_root_root_docker_serviceexec_ownership_root_root_docker_socketexec_ownership_root_root_etc_default_dockerexec_ownership_root_root_etc_dockerexec_ownership_root_root_etc_sysconfig_dockerexec_ownership_root_root_registry_certificateexec_ownership_root_root_tls_ca_certificateexec_permissions_400_docker_server_certificate_keyexec_permissions_444_docker_server_certificateexec_permissions_444_registry_certificateexec_permissions_444_tls_ca_certificateexec_permissions_600_docker_containerd_socketexec_permissions_644_daemon_jsonexec_permissions_644_docker_serviceexec_permissions_644_docker_socketexec_permissions_644_etc_default_dockerexec_permissions_644_etc_sysconfig_dockerexec_permissions_660_docker_sockexec_permissions_755_etc_dockerexec_separate_partition_for_containers_createdexec_swarm_services_bound_to_specific_host_interfaceexec_tls_authentication_docker_daemon_configuredexec_userland_proxy_disabled

Query: exec_ownership_root_root_etc_default_docker

Usage

steampipe query docker_compliance.query.exec_ownership_root_root_etc_default_docker

Plugins & Tables

SQL

with os_output as (
select
btrim(stdout_output, E ' \n\r\t') as os,
_ctx ->> 'connection_name' as os_conn
from
exec_command
where
command = 'uname -s'
),
hostname as (
select
btrim(stdout_output, E ' \n\r\t') as host,
_ctx ->> 'connection_name' as host_conn,
_ctx
from
exec_command
where
command = 'hostname'
),
linux_output as (
select
stdout_output,
stderr_output,
_ctx ->> 'connection_name' as conn
from
exec_command,
os_output
where
os_conn = _ctx ->> 'connection_name'
and command = 'stat -c %U:%G /etc/default/docker | grep -v root:root'
)
select
host as resource,
case
when os.os ilike '%Darwin%' then 'skip'
when o.stderr_output like '%No such file or directory%' then 'skip'
when o.stdout_output = '' then 'ok'
else 'alarm'
end as status,
case
when os.os ilike '%Darwin%' then host || ' /etc/default/docker does not exist on ' || os.os || ' OS.'
when o.stderr_output like '%No such file or directory%' then host || ' recommendation is not applicable as the file is unavailable.'
when o.stdout_output = '' then host || ' /etc/default/docker file ownership is set to root:root.'
else host || ' /etc/default/docker file ownership is not set to root:root.'
end as reason,
h._ctx ->> 'connection_name' as connection_name
from
hostname as h,
os_output as os,
linux_output as o
where
os.os_conn = h.host_conn
and h.host_conn = o.conn;

Controls

The query is being used by the following controls: