-
Notifications
You must be signed in to change notification settings - Fork 114
/
inspec.yml
111 lines (111 loc) · 3.58 KB
/
inspec.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
---
name: cis-docker-benchmark
title: CIS Docker Benchmark Profile
maintainer: DevSec Hardening Framework Team
copyright: DevSec Hardening Framework Team
copyright_email: [email protected]
license: Apache-2.0
summary: An InSpec Compliance Profile for the CIS Docker Benchmark
version: 2.1.4
inspec_version: '>= 4.6.3'
attributes:
- name: container_user
required: false
description: 'define user within containers.'
value: 'ubuntu'
type: string
- name: container_capadd
required: true
description: 'define needed capabilities for containers.'
type: string
value: NET_ADMIN,SYS_ADMIN
- name: app_armor_profile
required: false
description: 'define apparmor profile for Docker containers.'
value: 'docker-default'
type: string
- name: selinux_profile
required: false
description: 'define SELinux profile for Docker containers.'
value: label:level:s0-s0:c1023
type: string
- name: trusted_user
required: false
description: 'define trusted user to control Docker daemon.'
value: vagrant
type: string
- name: managable_container_number
required: true
description: 'keep number of containers on a host to a manageable total.'
value: 25
type: numeric
- name: benchmark_version
required: true
description: 'to execute also the old controls from previous benchmarks. to execute the controls, define the value as 1.12.0'
type: string
value: 1.12.0
- name: registry_cert_path
required: true
description: 'directory contains various Docker registry directories.'
value: '/etc/docker/certs.d'
type: string
- name: registry_name
required: true
description: 'directory contain certificate certain Docker registry.'
value: '/etc/docker/certs.d/registry_hostname:port'
type: string
- name: registry_ca_file
required: false
description: 'directory contain certificate certain Docker registry.'
value: '/etc/docker/certs.d/registry_hostname:port/ca.crt'
type: string
- name: daemon_tlscacert
required: false
description: 'Trust certs signed only by this CA'
value: '/etc/docker/ssl/ca.pem'
type: string
- name: daemon_tlscert
required: false
description: 'Path to TLS certificate file'
value: '/etc/docker/ssl/server_cert.pem'
type: string
- name: daemon_tlskey
required: false
description: 'Path to TLS key file'
value: '/etc/docker/ssl/server_key.pem'
type: string
- name: authorization_plugin
required: false
description: 'define authorization plugin to manage access to Docker daemon.'
value: 'authz-broker'
type: string
- name: log_driver
required: false
description: 'define preferable way to store logs.'
value: 'syslog'
type: string
- name: log_opts
required: false
description: 'define Docker daemon log-opts.'
value: syslog-address
type: string
- name: swarm_mode
required: false
description: 'define the swarm mode, `active` or `inactive`'
value: inactive
type: string
- name: swarm_max_manager_nodes
required: false
description: 'number of manager nodes in a swarm'
value: 3
type: numeric
- name: swarm_port
required: false
description: 'port of the swarm node'
value: 2377
type: numeric
- name: seccomp_default_profile
required: false
description: 'define the default seccomp profile'
value: 'default'
type: string