turbot/docker_compliance
GitHub
docker_container_apparmor_profile_enableddocker_container_cgroup_usagedocker_container_cpu_priority_setdocker_container_default_seccomp_profile_disableddocker_container_default_ulimitdocker_container_healthcheck_instructiondocker_container_host_devices_exposeddocker_container_host_ipc_namespace_shareddocker_container_host_network_namespace_shareddocker_container_host_process_namespace_shareddocker_container_host_system_directories_mounteddocker_container_host_user_namespace_shareddocker_container_host_uts_namespace_shareddocker_container_memory_usage_limitdocker_container_mount_propagation_mode_shareddocker_container_no_new_privilegesdocker_container_pid_cgroup_limit_useddocker_container_privilegeddocker_container_restart_policy_on_failuredocker_container_root_filesystem_mounteddocker_info_aufs_storage_driver_unuseddocker_info_centralized_and_remote_logging_configureddocker_info_container_sprawl_avoideddocker_info_custom_seccomp_profile_applieddocker_info_insecure_registries_unuseddocker_info_live_restore_enableddocker_info_swarm_manager_auto_lock_modedocker_info_swarm_minimum_required_manager_nodesdocker_info_swarm_mode_enableddocker_info_swarm_node_cert_expiry_setdocker_info_user_namespace_support_enableddocker_network_traffic_restricted_between_containersexec_auditing_configured_containerd_sockexec_auditing_configured_docker_daemonexec_auditing_configured_docker_serviceexec_auditing_configured_docker_socketexec_auditing_configured_etc_containerd_configexec_auditing_configured_etc_default_dockerexec_auditing_configured_etc_dockerexec_auditing_configured_etc_docker_daemonexec_auditing_configured_etc_sysconfig_dockerexec_auditing_configured_run_containerdexec_auditing_configured_usr_bin_containerdexec_auditing_configured_usr_bin_containerd_shimexec_auditing_configured_usr_bin_containerd_shim_runc_v1exec_auditing_configured_usr_bin_containerd_shim_runc_v2exec_auditing_configured_usr_bin_runcexec_auditing_configured_var_lib_dockerexec_authorization_docker_client_command_enabledexec_base_device_size_changedexec_containers_no_new_privilege_disabledexec_default_ulimit_configuredexec_docker_container_non_root_userexec_docker_container_trust_enabledexec_docker_daemon_run_as_root_userexec_docker_exec_command_no_privilege_optionexec_docker_exec_command_no_user_root_optionexec_docker_iptables_not_setexec_docker_socket_not_mounted_inside_containersexec_logging_level_set_to_infoexec_ownership_root_docker_socketexec_ownership_root_root_daemon_jsonexec_ownership_root_root_docker_containerd_socketexec_ownership_root_root_docker_server_certificateexec_ownership_root_root_docker_server_certificate_keyexec_ownership_root_root_docker_serviceexec_ownership_root_root_docker_socketexec_ownership_root_root_etc_default_dockerexec_ownership_root_root_etc_dockerexec_ownership_root_root_etc_sysconfig_dockerexec_ownership_root_root_registry_certificateexec_ownership_root_root_tls_ca_certificateexec_permissions_400_docker_server_certificate_keyexec_permissions_444_docker_server_certificateexec_permissions_444_registry_certificateexec_permissions_444_tls_ca_certificateexec_permissions_600_docker_containerd_socketexec_permissions_644_daemon_jsonexec_permissions_644_docker_serviceexec_permissions_644_docker_socketexec_permissions_644_etc_default_dockerexec_permissions_644_etc_sysconfig_dockerexec_permissions_660_docker_sockexec_permissions_755_etc_dockerexec_separate_partition_for_containers_createdexec_swarm_services_bound_to_specific_host_interfaceexec_tls_authentication_docker_daemon_configuredexec_userland_proxy_disabled

Query: exec_permissions_400_docker_server_certificate_key

Usage

steampipe query docker_compliance.query.exec_permissions_400_docker_server_certificate_key

Plugins & Tables

SQL

with os_output as (
select
btrim(stdout_output, E ' \n\r\t') as os,
_ctx ->> 'connection_name' as os_conn
from
exec_command
where
command = 'uname -s'
),
hostname as (
select
btrim(stdout_output, E ' \n\r\t') as host,
_ctx ->> 'connection_name' as host_conn,
_ctx
from
exec_command
where
command = 'hostname'
),
linux_output as (
with json_value_cte as (
select
-- Use the colon as a "true" command that returns an empty string
case
when stdout_output = ''
or (stdout_output :: jsonb ->> 'tlscacert') is null then ':'
else 'stat -c %a ' || (stdout_output :: jsonb ->> 'tlskey')
end as key_value,
_ctx ->> 'connection_name' as os_conn
from
exec_command,
os_output
where
os_conn = _ctx ->> 'connection_name'
and command = 'cat /etc/docker/daemon.json'
order by
key_value
)
select
stdout_output,
_ctx ->> 'connection_name' as conn
from
json_value_cte as a
join exec_command on command = a.key_value
where
os_conn = _ctx ->> 'connection_name'
)
select
host as resource,
case
when os.os ilike '%Darwin%' then 'skip'
when o.stdout_output = '' then 'skip'
when o.stdout_output like '%400%' then 'ok'
else 'alarm'
end as status,
case
when os.os ilike '%Darwin%' then host || ' /etc/docker/daemon.json does not exist on ' || os.os || ' OS.'
when o.stdout_output = '' then host || ' TLS CA certificate file does not exist.'
when o.stdout_output like '%400%' then host || ' server certificate key file permissions are set to 400.'
else host || ' server certificate key file permissions are set to ' || (btrim(o.stdout_output, E ' \n\r\t')) || '.'
end as reason,
h._ctx ->> 'connection_name' as connection_name
from
hostname as h,
os_output as os,
linux_output as o
where
os.os_conn = h.host_conn
and h.host_conn = o.conn;

Controls

The query is being used by the following controls: