diff --git a/yaml/docker-compose/security/exposing-docker-socket-volume.test.yaml b/yaml/docker-compose/security/exposing-docker-socket-volume.test.yaml index 344c37b17e..bc9de10584 100644 --- a/yaml/docker-compose/security/exposing-docker-socket-volume.test.yaml +++ b/yaml/docker-compose/security/exposing-docker-socket-volume.test.yaml @@ -264,3 +264,22 @@ services: # ruleid: exposing-docker-socket-volume volumes: - /var/run/docker.sock:/run/docker.sock +--- +services: + versionless: + image: alpine:latest + # ruleid: exposing-docker-socket-volume + volumes: + - /var/run/docker.sock:/var/run/docker.sock +--- +name: CI +on: [push] +jobs: + test: + runs-on: ubuntu-latest + services: + docker: + image: docker:dind + # ok: exposing-docker-socket-volume + volumes: + - /var/run/docker.sock:/var/run/docker.sock diff --git a/yaml/docker-compose/security/exposing-docker-socket-volume.yaml b/yaml/docker-compose/security/exposing-docker-socket-volume.yaml index 098f68c992..5ecf7a0843 100644 --- a/yaml/docker-compose/security/exposing-docker-socket-volume.yaml +++ b/yaml/docker-compose/security/exposing-docker-socket-volume.yaml @@ -2,8 +2,15 @@ rules: - id: exposing-docker-socket-volume patterns: - pattern-inside: | - version: ... - ... + services: + ... + - pattern-not-inside: | + jobs: + ... + $JOB: + ... + services: + ... - pattern-either: - pattern: | volumes: diff --git a/yaml/docker-compose/security/no-new-privileges.test.yaml b/yaml/docker-compose/security/no-new-privileges.test.yaml index 851476a9e6..85e8209f02 100644 --- a/yaml/docker-compose/security/no-new-privileges.test.yaml +++ b/yaml/docker-compose/security/no-new-privileges.test.yaml @@ -14,3 +14,18 @@ services: security_opt: - no-new-privileges:true - another-opt:true +--- +services: + # ruleid: no-new-privileges + versionless: + image: nginx:alpine +--- +name: CI +on: [push] +jobs: + test: + runs-on: ubuntu-latest + services: + # ok: no-new-privileges + postgres: + image: postgres:16 diff --git a/yaml/docker-compose/security/no-new-privileges.yaml b/yaml/docker-compose/security/no-new-privileges.yaml index 92f429afea..42ee6f9bad 100644 --- a/yaml/docker-compose/security/no-new-privileges.yaml +++ b/yaml/docker-compose/security/no-new-privileges.yaml @@ -2,10 +2,15 @@ rules: - id: no-new-privileges patterns: - pattern-inside: | - version: ... - ... services: ... + - pattern-not-inside: | + jobs: + ... + $JOB: + ... + services: + ... - pattern: | $SERVICE: ... diff --git a/yaml/docker-compose/security/privileged-service.test.yaml b/yaml/docker-compose/security/privileged-service.test.yaml index a95f30c4f8..06a9d559d4 100644 --- a/yaml/docker-compose/security/privileged-service.test.yaml +++ b/yaml/docker-compose/security/privileged-service.test.yaml @@ -10,3 +10,20 @@ services: # ok: privileged-service db: image: mysql +--- +services: + versionless: + image: alpine:latest + # ruleid: privileged-service + privileged: true +--- +name: CI +on: [push] +jobs: + test: + runs-on: ubuntu-latest + services: + docker: + image: docker:dind + # ok: privileged-service + privileged: true diff --git a/yaml/docker-compose/security/privileged-service.yaml b/yaml/docker-compose/security/privileged-service.yaml index 3e314fb3ec..4909adcc1a 100644 --- a/yaml/docker-compose/security/privileged-service.yaml +++ b/yaml/docker-compose/security/privileged-service.yaml @@ -2,13 +2,18 @@ rules: - id: privileged-service patterns: - pattern-inside: | - version: ... - ... services: ... $SERVICE: ... privileged: $TRUE + - pattern-not-inside: | + jobs: + ... + $JOB: + ... + services: + ... - focus-metavariable: $TRUE - metavariable-regex: metavariable: $TRUE diff --git a/yaml/docker-compose/security/seccomp-confinement-disabled.test.yaml b/yaml/docker-compose/security/seccomp-confinement-disabled.test.yaml index 4a9a711222..35e93e1af4 100644 --- a/yaml/docker-compose/security/seccomp-confinement-disabled.test.yaml +++ b/yaml/docker-compose/security/seccomp-confinement-disabled.test.yaml @@ -13,3 +13,22 @@ services: image: mysql security_opt: - seccomp:unconfined +--- +services: + # ruleid: seccomp-confinement-disabled + versionless: + image: alpine:latest + security_opt: + - seccomp:unconfined +--- +name: CI +on: [push] +jobs: + test: + runs-on: ubuntu-latest + services: + # ok: seccomp-confinement-disabled + docker: + image: docker:dind + security_opt: + - seccomp:unconfined diff --git a/yaml/docker-compose/security/seccomp-confinement-disabled.yaml b/yaml/docker-compose/security/seccomp-confinement-disabled.yaml index b77e605f42..22bb7aed0b 100644 --- a/yaml/docker-compose/security/seccomp-confinement-disabled.yaml +++ b/yaml/docker-compose/security/seccomp-confinement-disabled.yaml @@ -2,10 +2,15 @@ rules: - id: seccomp-confinement-disabled patterns: - pattern-inside: | - version: ... - ... services: ... + - pattern-not-inside: | + jobs: + ... + $JOB: + ... + services: + ... - pattern: | $SERVICE: ... @@ -19,7 +24,7 @@ rules: the service in an unrestricted state. Remove 'seccomp:unconfined' to prevent this. metadata: cwe: - - 'CWE-284: Improper Access Control' + - 'CWE-250: Execution with Unnecessary Privileges' references: - https://docs.docker.com/engine/security/seccomp/ category: security diff --git a/yaml/docker-compose/security/selinux-separation-disabled.test.yaml b/yaml/docker-compose/security/selinux-separation-disabled.test.yaml index 381491dfa1..1dde845413 100644 --- a/yaml/docker-compose/security/selinux-separation-disabled.test.yaml +++ b/yaml/docker-compose/security/selinux-separation-disabled.test.yaml @@ -13,3 +13,22 @@ services: image: mysql security_opt: - label:disable +--- +services: + # ruleid: selinux-separation-disabled + versionless: + image: alpine:latest + security_opt: + - label:disable +--- +name: CI +on: [push] +jobs: + test: + runs-on: ubuntu-latest + services: + # ok: selinux-separation-disabled + docker: + image: docker:dind + security_opt: + - label:disable diff --git a/yaml/docker-compose/security/selinux-separation-disabled.yaml b/yaml/docker-compose/security/selinux-separation-disabled.yaml index 5a7a048748..975629b16e 100644 --- a/yaml/docker-compose/security/selinux-separation-disabled.yaml +++ b/yaml/docker-compose/security/selinux-separation-disabled.yaml @@ -2,10 +2,15 @@ rules: - id: selinux-separation-disabled patterns: - pattern-inside: | - version: ... - ... services: ... + - pattern-not-inside: | + jobs: + ... + $JOB: + ... + services: + ... - pattern: | $SERVICE: ... @@ -19,7 +24,7 @@ rules: service as an unconfined type. Remove 'label:disable' to prevent this. metadata: cwe: - - 'CWE-284: Improper Access Control' + - 'CWE-250: Execution with Unnecessary Privileges' references: - https://www.projectatomic.io/blog/2016/03/dwalsh_selinux_containers/ - https://docs.docker.com/engine/reference/run/#security-configuration diff --git a/yaml/docker-compose/security/writable-filesystem-service.test.yaml b/yaml/docker-compose/security/writable-filesystem-service.test.yaml index c96df926c7..1d87e04775 100644 --- a/yaml/docker-compose/security/writable-filesystem-service.test.yaml +++ b/yaml/docker-compose/security/writable-filesystem-service.test.yaml @@ -11,3 +11,18 @@ services: db: image: mysql read_only: true +--- +services: + # ruleid: writable-filesystem-service + versionless: + image: nginx:alpine +--- +name: CI +on: [push] +jobs: + test: + runs-on: ubuntu-latest + services: + # ok: writable-filesystem-service + postgres: + image: postgres:16 diff --git a/yaml/docker-compose/security/writable-filesystem-service.yaml b/yaml/docker-compose/security/writable-filesystem-service.yaml index 1d1094f7a7..2b6792f286 100644 --- a/yaml/docker-compose/security/writable-filesystem-service.yaml +++ b/yaml/docker-compose/security/writable-filesystem-service.yaml @@ -2,10 +2,15 @@ rules: - id: writable-filesystem-service patterns: - pattern-inside: | - version: ... - ... services: ... + - pattern-not-inside: | + jobs: + ... + $JOB: + ... + services: + ... - pattern: | $SERVICE: ...