35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
#!/usr/bin/python
|
||
#coding: utf-8
|
||
|
||
import os, re, public
|
||
|
||
_title = 'Whether to enable Docker log audit check'
|
||
_version = 1.0 # 版本
|
||
_ps = "Whether to enable Docker log audit check" # 描述
|
||
_level = 0 # 风险级别： 1.提示(低) 2.警告(中) 3.危险(高)
|
||
_date = '2023-03-13' # 最后更新时间
|
||
_ignore = os.path.exists("data/warning/ignore/sw_audit_docker.pl")
|
||
_tips = [
|
||
"Add -w /usr/bin/docker -k docker from [/etc/audit/rules.d/audit.rules] file",
|
||
"Restart auditd process: systemctl restart auditd"
|
||
]
|
||
_help = ''
|
||
|
||
|
||
def check_run():
|
||
'''
|
||
@name 开始检测
|
||
@return tuple (status<bool>,msg<string>)
|
||
'''
|
||
audit_path = '/etc/audit/audit.rules'
|
||
if not os.path.exists(audit_path):
|
||
return False, 'Risky, the auditd audit tool is not installed'
|
||
# auditctl -l命令列出当前auditd规则，匹配是否有对docker做审计记录
|
||
result = public.ExecShell('auditctl -l')[0].strip()
|
||
rep = '/usr/bin/docker'
|
||
if re.search(rep, result):
|
||
return True, 'Risk-free'
|
||
else:
|
||
return False, 'Risky, the docker audit log is not enabled'
|
||
|