|
| 1 | +--- |
1 | 2 | name: cis-docker-benchmark
|
2 | 3 | title: CIS Docker Benchmark Profile
|
3 | 4 | maintainer: DevSec Hardening Framework Team
|
4 | 5 | copyright: DevSec Hardening Framework Team
|
5 | 6 | copyright_email: [email protected]
|
6 | 7 | license: Apache-2.0
|
7 | 8 | summary: An InSpec Compliance Profile for the CIS Docker Benchmark
|
8 |
| -version: 2.1.0 |
| 9 | +version: 1.3.1 |
9 | 10 | inspec_version: '>= 2.3.23'
|
10 | 11 | attributes:
|
11 |
| - - name: container_user |
12 |
| - required: false |
13 |
| - description: 'define user within containers.' |
14 |
| - value: 'ubuntu' |
15 |
| - type: string |
16 |
| - - name: container_capadd |
17 |
| - required: true |
18 |
| - description: 'define needed capabilities for containers.' |
19 |
| - type: string |
20 |
| - value: NET_ADMIN,SYS_ADMIN |
21 |
| - - name: app_armor_profile |
22 |
| - required: false |
23 |
| - description: 'define apparmor profile for Docker containers.' |
24 |
| - value: 'docker-default' |
25 |
| - type: string |
26 |
| - - name: selinux_profile |
27 |
| - required: false |
28 |
| - description: 'define SELinux profile for Docker containers.' |
29 |
| - value: label:level:s0-s0:c1023 |
30 |
| - type: string |
31 |
| - - name: trusted_user |
32 |
| - required: false |
33 |
| - description: 'define trusted user to control Docker daemon.' |
34 |
| - value: vagrant |
35 |
| - type: string |
36 |
| - - name: managable_container_number |
37 |
| - required: true |
38 |
| - description: 'keep number of containers on a host to a manageable total.' |
39 |
| - value: 25 |
40 |
| - type: numeric |
41 |
| - - name: benchmark_version |
42 |
| - required: true |
43 |
| - description: 'to execute also the old controls from previous benchmarks. to execute the controls, define the value as 1.12.0' |
44 |
| - type: string |
45 |
| - value: 1.12.0 |
46 |
| - - name: registry_cert_path |
47 |
| - required: true |
48 |
| - description: 'directory contains various Docker registry directories.' |
49 |
| - value: '/etc/docker/certs.d' |
50 |
| - type: string |
51 |
| - - name: registry_name |
52 |
| - required: true |
53 |
| - description: 'directory contain certificate certain Docker registry.' |
54 |
| - value: '/etc/docker/certs.d/registry_hostname:port' |
55 |
| - type: string |
56 |
| - - name: registry_ca_file |
57 |
| - required: false |
58 |
| - description: 'directory contain certificate certain Docker registry.' |
59 |
| - value: '/etc/docker/certs.d/registry_hostname:port/ca.crt' |
60 |
| - type: string |
61 |
| - - name: daemon_tlscacert |
62 |
| - required: false |
63 |
| - description: 'Trust certs signed only by this CA' |
64 |
| - value: '/etc/docker/ssl/ca.pem' |
65 |
| - type: string |
66 |
| - - name: daemon_tlscert |
67 |
| - required: false |
68 |
| - description: 'Path to TLS certificate file' |
69 |
| - value: '/etc/docker/ssl/server_cert.pem' |
70 |
| - type: string |
71 |
| - - name: daemon_tlskey |
72 |
| - required: false |
73 |
| - description: 'Path to TLS key file' |
74 |
| - value: '/etc/docker/ssl/server_key.pem' |
75 |
| - type: string |
76 |
| - - name: authorization_plugin |
77 |
| - required: false |
78 |
| - description: 'define authorization plugin to manage access to Docker daemon.' |
79 |
| - value: 'authz-broker' |
80 |
| - type: string |
81 |
| - - name: log_driver |
82 |
| - required: false |
83 |
| - description: 'define preferable way to store logs.' |
84 |
| - value: 'syslog' |
85 |
| - type: string |
86 |
| - - name: log_opts |
87 |
| - required: false |
88 |
| - description: 'define Docker daemon log-opts.' |
89 |
| - value: syslog-address |
90 |
| - type: string |
91 |
| - - name: swarm_mode |
92 |
| - required: false |
93 |
| - description: 'define the swarm mode, `active` or `inactive`' |
94 |
| - value: inactive |
95 |
| - type: string |
96 |
| - - name: swarm_max_manager_nodes |
97 |
| - required: false |
98 |
| - description: 'number of manager nodes in a swarm' |
99 |
| - value: 3 |
100 |
| - type: numeric |
101 |
| - - name: swarm_port |
102 |
| - required: false |
103 |
| - description: 'port of the swarm node' |
104 |
| - value: 2377 |
105 |
| - type: numeric |
106 |
| - - name: seccomp_default_profile |
107 |
| - required: false |
108 |
| - description: 'define the default seccomp profile' |
109 |
| - value: 'default' |
110 |
| - type: string |
| 12 | + - name: container_user |
| 13 | + required: false |
| 14 | + description: 'define user within containers.' |
| 15 | + value: 'ubuntu' |
| 16 | + type: string |
| 17 | + - name: container_capadd |
| 18 | + required: true |
| 19 | + description: 'define needed capabilities for containers.' |
| 20 | + type: string |
| 21 | + value: NET_ADMIN,SYS_ADMIN |
| 22 | + - name: app_armor_profile |
| 23 | + required: false |
| 24 | + description: 'define apparmor profile for Docker containers.' |
| 25 | + value: 'docker-default' |
| 26 | + type: string |
| 27 | + - name: selinux_profile |
| 28 | + required: false |
| 29 | + description: 'define SELinux profile for Docker containers.' |
| 30 | + value: label:level:s0-s0:c1023 |
| 31 | + type: string |
| 32 | + - name: trusted_user |
| 33 | + required: false |
| 34 | + description: 'define trusted user to control Docker daemon.' |
| 35 | + value: vagrant |
| 36 | + type: string |
| 37 | + - name: managable_container_number |
| 38 | + required: true |
| 39 | + description: 'keep number of containers on a host to a manageable total.' |
| 40 | + value: 25 |
| 41 | + type: numeric |
| 42 | + - name: benchmark_version |
| 43 | + required: true |
| 44 | + description: 'to execute also the old controls from previous benchmarks. to execute the controls, define the value as 1.12.0' |
| 45 | + type: string |
| 46 | + value: 1.12.0 |
| 47 | + - name: registry_cert_path |
| 48 | + required: true |
| 49 | + description: 'directory contains various Docker registry directories.' |
| 50 | + value: '/etc/docker/certs.d' |
| 51 | + type: string |
| 52 | + - name: registry_name |
| 53 | + required: true |
| 54 | + description: 'directory contain certificate certain Docker registry.' |
| 55 | + value: '/etc/docker/certs.d/registry_hostname:port' |
| 56 | + type: string |
| 57 | + - name: registry_ca_file |
| 58 | + required: false |
| 59 | + description: 'directory contain certificate certain Docker registry.' |
| 60 | + value: '/etc/docker/certs.d/registry_hostname:port/ca.crt' |
| 61 | + type: string |
| 62 | + - name: daemon_tlscacert |
| 63 | + required: false |
| 64 | + description: 'Trust certs signed only by this CA' |
| 65 | + value: '/etc/docker/ssl/ca.pem' |
| 66 | + type: string |
| 67 | + - name: daemon_tlscert |
| 68 | + required: false |
| 69 | + description: 'Path to TLS certificate file' |
| 70 | + value: '/etc/docker/ssl/server_cert.pem' |
| 71 | + type: string |
| 72 | + - name: daemon_tlskey |
| 73 | + required: false |
| 74 | + description: 'Path to TLS key file' |
| 75 | + value: '/etc/docker/ssl/server_key.pem' |
| 76 | + type: string |
| 77 | + - name: authorization_plugin |
| 78 | + required: false |
| 79 | + description: 'define authorization plugin to manage access to Docker daemon.' |
| 80 | + value: 'authz-broker' |
| 81 | + type: string |
| 82 | + - name: log_driver |
| 83 | + required: false |
| 84 | + description: 'define preferable way to store logs.' |
| 85 | + value: 'syslog' |
| 86 | + type: string |
| 87 | + - name: log_opts |
| 88 | + required: false |
| 89 | + description: 'define Docker daemon log-opts.' |
| 90 | + value: syslog-address |
| 91 | + type: string |
| 92 | + - name: swarm_mode |
| 93 | + required: false |
| 94 | + description: 'define the swarm mode, `active` or `inactive`' |
| 95 | + value: inactive |
| 96 | + type: string |
| 97 | + - name: swarm_max_manager_nodes |
| 98 | + required: false |
| 99 | + description: 'number of manager nodes in a swarm' |
| 100 | + value: 3 |
| 101 | + type: numeric |
| 102 | + - name: swarm_port |
| 103 | + required: false |
| 104 | + description: 'port of the swarm node' |
| 105 | + value: 2377 |
| 106 | + type: numeric |
| 107 | + - name: seccomp_default_profile |
| 108 | + required: false |
| 109 | + description: 'define the default seccomp profile' |
| 110 | + value: 'default' |
| 111 | + type: string |
0 commit comments