From d0d9900b29f46a5d1d2d5f81a05ef3dc7ff8a0ff Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Fri, 30 Jun 2017 11:40:39 +0000
Subject: [PATCH 1/7] Resolve issue #7 wait: error running audit command exit
 status 1.

This is caused by a command in the audit pipeline (for example
ps -ef | grep kube-apiserver) failing. The causes of this failure
in my testing is usually a missing config file.

Extensive refactor and correction in verification code to check for
config files and binaries.

Replace joncalhoun/pipes with implementation using exec.Cmds so errors
are visible and can be handled when audit pipeline commands fail.

Change some audit commands
from: ps -ef | grep <cmd> | grep -v
to:   ps -C <something> -o comm,args --no-headers

which is simpler to work with.
---
 cfg/federated.yaml |  40 ++++-----
 cfg/master.yaml    |  98 +++++++++++-----------
 cfg/node.yaml      |  26 +++---
 check/check.go     |  66 ++++++++-------
 cmd/common.go      | 200 +++++++++++++++++++++++++--------------------
 cmd/root.go        |   6 +-
 6 files changed, 233 insertions(+), 203 deletions(-)

diff --git a/cfg/federated.yaml b/cfg/federated.yaml
index ddbb6bb..ca9ef26 100644
--- a/cfg/federated.yaml
+++ b/cfg/federated.yaml
@@ -9,7 +9,7 @@ groups:
   checks:
      - id: 3.1.1
        text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
            - flag: "--anonymous-auth"
@@ -23,7 +23,7 @@ groups:
 
      - id: 3.1.2
        text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
            - flag: "--basic-auth-file"
@@ -35,7 +35,7 @@ groups:
   
      - id: 3.1.3
        text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
            - flag: "--insecure-allow-any-token"
@@ -46,7 +46,7 @@ groups:
  
      - id: 3.1.4
        text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
            - flag: "--insecure-bind-address"
@@ -57,7 +57,7 @@ groups:
 
      - id: 3.1.5
        text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--insecure-port"
@@ -71,7 +71,7 @@ groups:
 
      - id: 3.1.6
        text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests: 
          bin_op: or
          test_items:
@@ -88,7 +88,7 @@ groups:
 
      - id: 3.1.7
        text: "Ensure that the --profiling argument is set to false (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--profiling"
@@ -102,7 +102,7 @@ groups:
 
      - id: 3.1.8
        text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--admission-control"
@@ -117,7 +117,7 @@ groups:
 
      - id: 3.1.9
        text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "admission-control"
@@ -131,7 +131,7 @@ groups:
 
      - id: 3.1.10
        text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--audit-log-path"
@@ -142,7 +142,7 @@ groups:
   
      - id: 3.1.11
        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--audit-log-maxage"
@@ -156,7 +156,7 @@ groups:
                
      - id: 3.1.12
        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--audit-log-maxbackup"
@@ -170,7 +170,7 @@ groups:
 
      - id: 3.1.13
        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--audit-log-maxsize"
@@ -184,7 +184,7 @@ groups:
 
      - id: 3.1.14
        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--authorization-mode"
@@ -198,7 +198,7 @@ groups:
  
      - id: 3.1.15
        text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--token-auth-file"
@@ -210,7 +210,7 @@ groups:
   
      - id: 3.1.16
        text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--service-account-lookup"
@@ -224,7 +224,7 @@ groups:
 
      - id: 3.1.17
        text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--service-account-key-file"
@@ -235,7 +235,7 @@ groups:
 
      - id: 3.1.18
        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          bin_op: and
          test_items:
@@ -252,7 +252,7 @@ groups:
 
      - id: 3.1.19
        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-       audit: "ps -ef | grep federation-apiserver | grep -v grep"
+       audit: "ps -C federation-apiserver -o cmd --no-headers"
        tests:
          bin_op: and
          test_items:
@@ -271,7 +271,7 @@ groups:
   checks:
      - id: 3.2.1
        text: "Ensure that the --profiling argument is set to false (Scored)"
-       audit: "ps -ef | grep federation-controller-manager | grep -v grep"
+       audit: "ps -C federation-controller-manager -o cmd --no-headers"
        tests:
          test_items:
          - flag: "--profiling"
diff --git a/cfg/master.yaml b/cfg/master.yaml
index 179b43a..a623cb4 100644
--- a/cfg/master.yaml
+++ b/cfg/master.yaml
@@ -9,7 +9,7 @@ groups:
   checks:
     - id: 1.1.1
       text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "allow-privileged"
@@ -23,7 +23,7 @@ groups:
 
     - id: 1.1.2
       text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--anonymous-auth"
@@ -37,7 +37,7 @@ groups:
 
     - id: 1.1.3
       text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--basic-auth-file"
@@ -50,7 +50,7 @@ groups:
 
     - id: 1.1.4
       text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag:  "--insecure-allow-any-token"
@@ -61,7 +61,7 @@ groups:
 
     - id: 1.1.5
       text: "Ensure that the --kubelet-https argument is set to true (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests: 
         bin_op: or
         test_items:
@@ -78,7 +78,7 @@ groups:
 
     - id: 1.1.6
       text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--insecure-bind-address"
@@ -89,7 +89,7 @@ groups:
 
     - id: 1.1.7
       text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--insecure-port"
@@ -103,7 +103,7 @@ groups:
 
     - id: 1.1.8
       text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests: 
         bin_op: or
         test_items:
@@ -121,7 +121,7 @@ groups:
 
     - id: 1.1.9
       text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--profiling"
@@ -135,7 +135,7 @@ groups:
 
     - id: 1.1.10
       text: "Ensure that the --repair-malformed-updates argument is set to false (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--repair-malformed-updates"
@@ -149,7 +149,7 @@ groups:
 
     - id: 1.1.11
       text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -163,7 +163,7 @@ groups:
  
     - id: 1.1.12
       text: "Ensure that the admission control policy is set to AlwaysPullImages (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -177,7 +177,7 @@ groups:
  
     - id: 1.1.13
       text: "Ensure that the admission control policy is set to DenyEscalatingExec (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -191,7 +191,7 @@ groups:
 
     - id: 1.1.14
       text: "Ensure that the admission control policy is set to SecurityContextDeny (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -205,7 +205,7 @@ groups:
 
     - id: 1.1.15
       text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "admission-control"
@@ -219,7 +219,7 @@ groups:
 
     - id: 1.1.16
       text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--audit-log-path"
@@ -230,7 +230,7 @@ groups:
 
     - id: 1.1.17
       text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--audit-log-maxage"
@@ -244,7 +244,7 @@ groups:
 
     - id: 1.1.18
       text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--audit-log-maxbackup"
@@ -258,7 +258,7 @@ groups:
 
     - id: 1.1.19
       text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--audit-log-maxsize"
@@ -272,7 +272,7 @@ groups:
 
     - id: 1.1.20
       text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--authorization-mode"
@@ -286,7 +286,7 @@ groups:
 
     - id: 1.1.21
       text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--token-auth-file"
@@ -298,7 +298,7 @@ groups:
  
     - id: 1.1.22
       text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--kubelet-certificate-authority"
@@ -311,7 +311,7 @@ groups:
 
     - id: 1.1.23
       text: "Ensure that the --kubelet-client-certificate and --kubelet-clientkey arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         bin_op: and
         test_items:
@@ -327,7 +327,7 @@ groups:
 
     - id: 1.1.24
       text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--service-account-lookup"
@@ -341,7 +341,7 @@ groups:
  
     - id: 1.1.25
       text: "Ensure that the admission control policy is set to PodSecurityPolicy (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -356,7 +356,7 @@ groups:
 
     - id: 1.1.26
       text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--service-account-key-file"
@@ -367,7 +367,7 @@ groups:
 
     - id: 1.1.27
       text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         bin_op: and
         test_items:
@@ -383,7 +383,7 @@ groups:
  
     - id: 1.1.28
       text: "Ensure that the admission control policy is set to ServiceAccount (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -398,7 +398,7 @@ groups:
 
     - id: 1.1.29
       text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         bin_op: and
         test_items:
@@ -414,7 +414,7 @@ groups:
 
     - id: 1.1.30
       text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--client-ca-file"
@@ -426,7 +426,7 @@ groups:
 
     - id: 1.1.31
       text: "Ensure that the --etcd-cafile argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
+      audit: "ps -C kube-apiserver -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--etcd-cafile"
@@ -441,7 +441,7 @@ groups:
   checks:
     - id: 1.2.1
       text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -ef | grep kube-scheduler | grep -v grep"
+      audit: "ps -C kube-scheduler -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--profiling"
@@ -458,7 +458,7 @@ groups:
   checks:
     - id: 1.3.1
       text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
+      audit: "ps -C kube-controller-manager -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--terminated-pod-gc-threshold"
@@ -469,7 +469,7 @@ groups:
  
     - id: 1.3.2
       text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
+      audit: "ps -C kube-controller-manager -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--profiling"
@@ -483,7 +483,7 @@ groups:
  
     - id: 1.3.3
       text: "Ensure that the --insecure-experimental-approve-all-kubelet-csrs-for-group argument is not set (Scored)"
-      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
+      audit: "ps -C kube-controller-manager -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--insecure-experimental-approve-all-kubelet-csrs-for-group"
@@ -495,7 +495,7 @@ groups:
 
     - id: 1.3.4
       text: "Ensure that the --use-service-account-credentials argument is set"
-      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
+      audit: "ps -C kube-controller-manager -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--use-service-account-credentials"
@@ -509,7 +509,7 @@ groups:
 
     - id: 1.3.5
       text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
+      audit: "ps -C kube-controller-manager -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--service-account-private-key-file"
@@ -520,7 +520,7 @@ groups:
 
     - id: 1.3.6
       text: "Ensure that the --root-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
+      audit: "ps -C kube-controller-manager -o cmd --no-headers"
       tests:
         test_items:
         - flag: "--root-ca-file"
@@ -644,9 +644,7 @@ groups:
       
     - id: 1.4.11
       text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      # audit: ps -ef | grep etcd | grep -v grep | sed 's,.*--data-dir=\(.*\)\s*.*,\1,' | xargs stat -c %a
-      audit: "ps -ef | grep etcd | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
-      # audit: xargs stat -c %a /etc/etcd
+      audit: "ps -C etcd -o cmd --no-headers | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
       tests:
         test_items:
         - flag: "700"
@@ -663,7 +661,7 @@ groups:
   checks:
     - id: 1.5.1
       text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--cert-file"
@@ -675,7 +673,7 @@ groups:
 
     - id: 1.5.2
       text: "Ensure that the --client-cert-auth argument is set to true (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--client-cert-auth"
@@ -691,7 +689,7 @@ groups:
 
     - id: 1.5.3
       text: "Ensure that the --auto-tls argument is not set to true (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         bin_op: or
         test_items:
@@ -709,7 +707,7 @@ groups:
 
     - id: 1.5.4
       text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--peer-cert-file"
@@ -724,7 +722,7 @@ groups:
 
     - id: 1.5.5
       text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--peer-client-cert-auth"
@@ -742,7 +740,7 @@ groups:
 
     - id: 1.5.6
       text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         bin_op: or
         test_items:
@@ -763,7 +761,7 @@ groups:
 
     - id: 1.5.7
       text: "Ensure that the --wal-dir argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--wal-dir"
@@ -776,7 +774,7 @@ groups:
 
     - id: 1.5.8
       text: "Ensure that the --max-wals argument is set to 0 (Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--max-wals"
@@ -792,7 +790,7 @@ groups:
 
     - id: 1.5.9
       text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
-      audit: "ps -ef | grep etcd | grep -v grep"
+      audit: "ps -C etcd -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--trusted-ca-file"
diff --git a/cfg/node.yaml b/cfg/node.yaml
index 4304264..01b227d 100644
--- a/cfg/node.yaml
+++ b/cfg/node.yaml
@@ -9,7 +9,7 @@ groups:
   checks:
     - id: 2.1.1
       text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--allow-privileged"
@@ -23,7 +23,7 @@ groups:
 
     - id: 2.1.2
       text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--anonymous-auth"
@@ -37,7 +37,7 @@ groups:
  
     - id: 2.1.3
       text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--authorization-mode"
@@ -51,7 +51,7 @@ groups:
    
     - id: 2.1.4
       text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--client-ca-file"
@@ -63,7 +63,7 @@ groups:
 
     - id: 2.1.5
       text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--read-only-port"
@@ -77,7 +77,7 @@ groups:
  
     - id: 2.1.6
       text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--streaming-connection-idle-timeout"
@@ -91,7 +91,7 @@ groups:
 
     - id: 2.1.7
       text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--protect-kernel-defaults"
@@ -105,7 +105,7 @@ groups:
 
     - id: 2.1.8
       text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         bin_op: or
         test_items:
@@ -122,7 +122,7 @@ groups:
 
     - id: 2.1.9
       text: "Ensure that the --keep-terminated-pod-volumes argument is set to false (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--keep-terminated-pod-volumes"
@@ -136,7 +136,7 @@ groups:
 
     - id: 2.1.10
       text: "Ensure that the --hostname-override argument is not set (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--hostname-override"
@@ -147,7 +147,7 @@ groups:
 
     - id: 2.1.11
       text: "Ensure that the --event-qps argument is set to 0 (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--event-qps"
@@ -161,7 +161,7 @@ groups:
 
     - id: 2.1.12
       text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--tls-cert-file"
@@ -176,7 +176,7 @@ groups:
 
     - id: 2.1.13
       text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
-      audit: "ps -ef | grep kubelet | grep -v grep"
+      audit: "ps -C kubelet -o cmd --no-headers"
       tests:
         test_items:
           - flag: "--cadvisor-port"
diff --git a/check/check.go b/check/check.go
index 947f85c..d67e82c 100644
--- a/check/check.go
+++ b/check/check.go
@@ -15,14 +15,12 @@
 package check
 
 import (
-	"bufio"
+	"bytes"
 	"fmt"
 	"io"
 	"os"
 	"os/exec"
 	"strings"
-
-	"github.com/joncalhoun/pipe"
 )
 
 // NodeType indicates the type of node (master, node, federated).
@@ -65,7 +63,7 @@ type Check struct {
 // Run executes the audit commands specified in a check and outputs
 // the results.
 func (c *Check) Run() {
-	var out string
+	var out bytes.Buffer
 
 	// Check if command exists or exit with WARN.
 	for _, cmd := range c.Commands {
@@ -77,47 +75,59 @@ func (c *Check) Run() {
 	}
 
 	// Run commands.
-	if len(c.Commands) == 0 {
+	n := len(c.Commands)
+	if n == 0 {
 		// Likely a warning message.
 		c.State = WARN
 		return
 	}
 
-	p, err := pipe.New(c.Commands...)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "init: error creating command pipeline %s\n", err)
-		os.Exit(1)
+	// Each command runs,
+	//   cmd0 out -> cmd1 in, cmd1 out -> cmd2 in ... cmdn out -> os.stdout
+	//   cmd0 err should terminate chain
+	cs := c.Commands
+
+	cs[0].Stderr = os.Stderr
+	cs[n-1].Stdout = &out
+	i := 1
+
+	for _, v := range cs {
+		fmt.Println(v.Args)
 	}
 
-	pr, pw := io.Pipe()
-	p.Stdout = pw
-	defer pw.Close()
+	var err error
+	for i < n {
+		cs[i-1].Stdout, err = cs[i].StdinPipe()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Path, err)
+			os.Exit(1)
+		}
 
-	if err := p.Start(); err != nil {
-		fmt.Fprintf(os.Stderr, "start: error running audit command %s\n", err)
-		os.Exit(1)
+		cs[i].Stderr = os.Stderr
+		i++
 	}
 
-	// Read output of command chain into string for check.
-	go func() {
-		defer pr.Close()
-		scanner := bufio.NewScanner(pr)
-		for scanner.Scan() {
-			out += scanner.Text()
+	i = 0
+	for i < n {
+		err := cs[i].Start()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, err)
+			os.Exit(1)
 		}
 
-		if err := scanner.Err(); err != nil {
-			fmt.Fprintf(os.Stderr, "error accumulating  output %s\n", err)
+		errw := cs[i].Wait()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, errw)
 			os.Exit(1)
 		}
-	}()
 
-	if err := p.Wait(); err != nil {
-		fmt.Fprintf(os.Stderr, "wait: error running audit command %s\n", err)
-		os.Exit(1)
+		if i < n-1 {
+			cs[i].Stdout.(io.Closer).Close()
+		}
+		i++
 	}
 
-	res := c.Tests.execute(out)
+	res := c.Tests.execute(out.String())
 	if res {
 		c.State = PASS
 	} else {
diff --git a/cmd/common.go b/cmd/common.go
index 8362ea2..90cbed0 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -19,7 +19,6 @@ import (
 	"io/ioutil"
 	"os"
 	"os/exec"
-	"regexp"
 	"strings"
 
 	"github.com/aquasecurity/kube-bench/check"
@@ -29,16 +28,16 @@ import (
 
 var (
 	kubeMasterBin  = []string{"kube-apiserver", "kube-scheduler", "kube-controller-manager"}
+	xMasterBin     = []string{"etcd", "flanneld"}
 	kubeMasterConf = []string{}
 
 	kubeNodeBin  = []string{"kubelet"}
 	kubeNodeConf = []string{}
 
-	kubeFederatedBin  = []string{"federation-apiserver", "federation-controller-manager"}
-	kubeFederatedConf = []string{}
+	kubeFederatedBin = []string{"federation-apiserver", "federation-controller-manager"}
 
 	// TODO: Consider specifying this in config file.
-	kubeVersion = "Kubernetes v1.6"
+	kubeVersion = "1.6"
 
 	// Used for variable substitution
 	symbols = map[string]string{}
@@ -54,26 +53,15 @@ var (
 
 func runChecks(t check.NodeType) {
 	var summary check.Summary
-	var warnings []string
 	var file string
 
-	// Set up for config file check.
-	kubeMasterConf = append(kubeMasterConf, viper.Get("kubeConfDir").(string)+"/apiserver")
-	kubeMasterConf = append(kubeMasterConf, viper.Get("kubeConfDir").(string)+"/scheduler")
-	kubeMasterConf = append(kubeMasterConf, viper.Get("kubeConfDir").(string)+"/controller-manager")
-	kubeMasterConf = append(kubeMasterConf, viper.Get("kubeConfDir").(string)+"/config")
-	kubeMasterConf = append(kubeMasterConf, viper.Get("etcdConfDir").(string)+"/etcd.conf")
-	kubeMasterConf = append(kubeMasterConf, viper.Get("flanneldConfDir").(string)+"/flanneld")
-	kubeNodeConf = append(kubeNodeConf, viper.Get("kubeConfDir").(string)+"/kubelet")
-	kubeNodeConf = append(kubeNodeConf, viper.Get("kubeConfDir").(string)+"/proxy")
-
-	warnings, err := verifyNodeType(t, warnings)
-	if err != nil {
-		for _, w := range warnings {
-			colorPrint(check.WARN, w)
+	fails := verifyNodeType(t)
+	if len(fails) > 0 {
+		fmt.Fprintf(os.Stderr, "%s could not start: please resolve these issues\n", os.Args[0])
+		for _, w := range fails {
+			colorPrint(check.FAIL, w)
 		}
 
-		fmt.Fprintf(os.Stderr, "failed to verify node type: %v\n", err)
 		os.Exit(1)
 	}
 
@@ -129,7 +117,7 @@ func runChecks(t check.NodeType) {
 
 		fmt.Println(string(out))
 	} else {
-		prettyPrint(warnings, controls, summary)
+		prettyPrint(fails, controls, summary)
 	}
 }
 
@@ -144,81 +132,42 @@ func cleanIDs(list string) []string {
 	return ids
 }
 
-// verifyNodeType checks the executables and config files are as expected for the specified tests (master, node or federated)
-func verifyNodeType(t check.NodeType, w []string) ([]string, error) {
-	var binPath []string
-	var confPath []string
-	var out []byte
+// verifyNodeType checks the executables and config files are as expected
+// for the specified tests (master, node or federated).
+// Any check failing here is a show stopper.
+func verifyNodeType(t check.NodeType) []string {
+	var w []string
 
-	switch t {
-	case check.MASTER:
-		binPath = kubeMasterBin
-		confPath = kubeMasterConf
-	case check.NODE:
-		binPath = kubeNodeBin
-		confPath = kubeNodeConf
-	case check.FEDERATED:
-		binPath = kubeFederatedBin
-		confPath = kubeFederatedConf
-	}
+	// Set up and check for config files.
+	kubeConfDir = viper.Get("kubeConfDir").(string)
+	etcdConfDir = viper.Get("etcdConfDir").(string)
+	flanneldConfDir = viper.Get("flanneldConfDir").(string)
 
-	// These executables might not be on the user's path.
-	// TODO! Check the version number using kubectl, which is more likely to be on the path.
-	for _, b := range binPath {
-		_, err := exec.LookPath(b)
-		if err != nil {
-			w = append(w, fmt.Sprintf("%s: command not found on path - version check skipped\n", b))
-			continue
-		}
+	kubeMasterConf = append(kubeMasterConf, kubeConfDir+"/apiserver")
+	kubeMasterConf = append(kubeMasterConf, kubeConfDir+"/scheduler")
+	kubeMasterConf = append(kubeMasterConf, kubeConfDir+"/controller-manager")
+	kubeMasterConf = append(kubeMasterConf, kubeConfDir+"/config")
+	kubeMasterConf = append(kubeMasterConf, etcdConfDir+"/etcd.conf")
+	kubeMasterConf = append(kubeMasterConf, flanneldConfDir+"/flanneld")
 
-		// Check version
-		cmd := exec.Command(b, "--version")
-		out, err = cmd.Output()
-		if err != nil {
-			return w, fmt.Errorf("failed executing %s --version: %v", b, err)
-		}
+	kubeNodeConf = append(kubeNodeConf, kubeConfDir+"/kubelet")
+	kubeNodeConf = append(kubeNodeConf, kubeConfDir+"/proxy")
 
-		matched, err := regexp.MatchString(kubeVersion, string(out))
-		if err != nil {
-			return w, fmt.Errorf("regexp match for version failed: %v", err)
-		}
+	w = append(w, verifyKubeVersion(kubeMasterBin)...)
 
-		if !matched {
-			return w, fmt.Errorf(
-				"%s unsupported version, expected %s, got %s",
-				b,
-				kubeVersion,
-				string(out),
-			)
-		}
-	}
-
-	// Check if the executables for this type of node are running.
-	for _, b := range binPath {
-		cmd := exec.Command("ps", "-ef")
-		out, err := cmd.Output()
-		if err != nil {
-			return w, fmt.Errorf("failed executing ps -ef: %v", err)
-		}
-
-		matched, err := regexp.MatchString(".*"+b, string(out))
-		if err != nil {
-			return w, fmt.Errorf("regexp match for ps output failed: %v", err)
-		}
-
-		if !matched {
-			return w, fmt.Errorf("%s is not running", b)
-		}
-	}
-
-	// Check whether the config files for this type of node are in the expected location
-	for _, c := range confPath {
-		if _, err := os.Stat(c); os.IsNotExist(err) {
-			w = append(w, fmt.Sprintf("config file %s does not exist\n", c))
-		}
+	switch t {
+	case check.MASTER:
+		w = append(w, verifyBin(kubeMasterBin)...)
+		w = append(w, verifyBin(xMasterBin)...)
+		w = append(w, verifyConf(kubeMasterConf)...)
+	case check.NODE:
+		w = append(w, verifyBin(kubeNodeBin)...)
+		w = append(w, verifyConf(kubeNodeConf)...)
+	case check.FEDERATED:
+		w = append(w, verifyBin(kubeFederatedBin)...)
 	}
 
-	return w, nil
+	return w
 }
 
 // colorPrint outputs the state in a specific colour, along with a message string
@@ -273,3 +222,76 @@ func prettyPrint(warnings []string, r *check.Controls, summary check.Summary) {
 		summary.Pass, summary.Fail, summary.Warn,
 	)
 }
+
+func verifyConf(confPath []string) []string {
+	var w []string
+	for _, c := range confPath {
+		if _, err := os.Stat(c); err != nil && os.IsNotExist(err) {
+			w = append(w, fmt.Sprintf("config file %s does not exist\n", c))
+		}
+	}
+
+	return w
+}
+
+func verifyBin(binPath []string) []string {
+	var w []string
+	var binList string
+
+	// Construct proc name for ps(1)
+	for _, b := range binPath {
+		binList += b + ","
+	}
+	binList = strings.Trim(binList, ",")
+
+	// Run ps command
+	cmd := exec.Command("ps", "-C", binList, "-o", "cmd", "--no-headers")
+	out, err := cmd.Output()
+	if err != nil {
+		w = append(w, fmt.Sprintf("%v could not get process information\n", binPath))
+	}
+
+	// Actual verification
+	for _, b := range binPath {
+		matched := strings.Contains(string(out), b)
+
+		if !matched {
+			w = append(w, fmt.Sprintf("%s is not running\n", b))
+		}
+	}
+
+	return w
+}
+
+func verifyKubeVersion(binPath []string) []string {
+	// These executables might not be on the user's path.
+	// TODO! Check the version number using kubectl, which is more likely to be on the path.
+	var w []string
+
+	for _, b := range binPath {
+		_, err := exec.LookPath(b)
+		if err != nil {
+			w = append(w, fmt.Sprintf("%s: command not found on path - version check skipped\n", b))
+			continue
+		}
+
+		// Check version
+		cmd := exec.Command(b, "--version")
+		out, err := cmd.Output()
+		if err != nil {
+			w = append(w, fmt.Sprintf("failed executing %s --version: %v\n", b, err))
+		}
+
+		matched := strings.Contains(string(out), kubeVersion)
+		if !matched {
+			w = append(w, fmt.Sprintf(
+				"%s unsupported version, expected %s, got %s\n",
+				b,
+				kubeVersion,
+				string(out),
+			))
+		}
+	}
+
+	return w
+}
diff --git a/cmd/root.go b/cmd/root.go
index b1c5bc4..e27ede0 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -34,9 +34,9 @@ var (
 	nodeFile      string
 	federatedFile string
 
-	kubeConfDir    string
-	etcdConfDir    string
-	flannelConfDir string
+	kubeConfDir     string
+	etcdConfDir     string
+	flanneldConfDir string
 )
 
 // RootCmd represents the base command when called without any subcommands

From e61dcabdfbd18fcefd551973ca610ca4e9846080 Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Fri, 30 Jun 2017 14:56:23 +0000
Subject: [PATCH 2/7] Remove extraneous debug commands.

---
 check/check.go | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/check/check.go b/check/check.go
index d67e82c..afab79a 100644
--- a/check/check.go
+++ b/check/check.go
@@ -91,10 +91,6 @@ func (c *Check) Run() {
 	cs[n-1].Stdout = &out
 	i := 1
 
-	for _, v := range cs {
-		fmt.Println(v.Args)
-	}
-
 	var err error
 	for i < n {
 		cs[i-1].Stdout, err = cs[i].StdinPipe()

From e6479afd01c7d3c7f79f19e567d99a2816741d2b Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Tue, 4 Jul 2017 15:19:09 +0000
Subject: [PATCH 3/7] Reset audit commands to ps -ef ... closer to benchmark.

---
 cfg/federated.yaml | 40 +++++++++----------
 cfg/master.yaml    | 98 +++++++++++++++++++++++-----------------------
 cfg/node.yaml      | 26 ++++++------
 3 files changed, 83 insertions(+), 81 deletions(-)

diff --git a/cfg/federated.yaml b/cfg/federated.yaml
index ca9ef26..ddbb6bb 100644
--- a/cfg/federated.yaml
+++ b/cfg/federated.yaml
@@ -9,7 +9,7 @@ groups:
   checks:
      - id: 3.1.1
        text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
            - flag: "--anonymous-auth"
@@ -23,7 +23,7 @@ groups:
 
      - id: 3.1.2
        text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
            - flag: "--basic-auth-file"
@@ -35,7 +35,7 @@ groups:
   
      - id: 3.1.3
        text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
            - flag: "--insecure-allow-any-token"
@@ -46,7 +46,7 @@ groups:
  
      - id: 3.1.4
        text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
            - flag: "--insecure-bind-address"
@@ -57,7 +57,7 @@ groups:
 
      - id: 3.1.5
        text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--insecure-port"
@@ -71,7 +71,7 @@ groups:
 
      - id: 3.1.6
        text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests: 
          bin_op: or
          test_items:
@@ -88,7 +88,7 @@ groups:
 
      - id: 3.1.7
        text: "Ensure that the --profiling argument is set to false (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--profiling"
@@ -102,7 +102,7 @@ groups:
 
      - id: 3.1.8
        text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--admission-control"
@@ -117,7 +117,7 @@ groups:
 
      - id: 3.1.9
        text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "admission-control"
@@ -131,7 +131,7 @@ groups:
 
      - id: 3.1.10
        text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--audit-log-path"
@@ -142,7 +142,7 @@ groups:
   
      - id: 3.1.11
        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--audit-log-maxage"
@@ -156,7 +156,7 @@ groups:
                
      - id: 3.1.12
        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--audit-log-maxbackup"
@@ -170,7 +170,7 @@ groups:
 
      - id: 3.1.13
        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--audit-log-maxsize"
@@ -184,7 +184,7 @@ groups:
 
      - id: 3.1.14
        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--authorization-mode"
@@ -198,7 +198,7 @@ groups:
  
      - id: 3.1.15
        text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--token-auth-file"
@@ -210,7 +210,7 @@ groups:
   
      - id: 3.1.16
        text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--service-account-lookup"
@@ -224,7 +224,7 @@ groups:
 
      - id: 3.1.17
        text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          test_items:
          - flag: "--service-account-key-file"
@@ -235,7 +235,7 @@ groups:
 
      - id: 3.1.18
        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          bin_op: and
          test_items:
@@ -252,7 +252,7 @@ groups:
 
      - id: 3.1.19
        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-       audit: "ps -C federation-apiserver -o cmd --no-headers"
+       audit: "ps -ef | grep federation-apiserver | grep -v grep"
        tests:
          bin_op: and
          test_items:
@@ -271,7 +271,7 @@ groups:
   checks:
      - id: 3.2.1
        text: "Ensure that the --profiling argument is set to false (Scored)"
-       audit: "ps -C federation-controller-manager -o cmd --no-headers"
+       audit: "ps -ef | grep federation-controller-manager | grep -v grep"
        tests:
          test_items:
          - flag: "--profiling"
diff --git a/cfg/master.yaml b/cfg/master.yaml
index a623cb4..179b43a 100644
--- a/cfg/master.yaml
+++ b/cfg/master.yaml
@@ -9,7 +9,7 @@ groups:
   checks:
     - id: 1.1.1
       text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "allow-privileged"
@@ -23,7 +23,7 @@ groups:
 
     - id: 1.1.2
       text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--anonymous-auth"
@@ -37,7 +37,7 @@ groups:
 
     - id: 1.1.3
       text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--basic-auth-file"
@@ -50,7 +50,7 @@ groups:
 
     - id: 1.1.4
       text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag:  "--insecure-allow-any-token"
@@ -61,7 +61,7 @@ groups:
 
     - id: 1.1.5
       text: "Ensure that the --kubelet-https argument is set to true (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests: 
         bin_op: or
         test_items:
@@ -78,7 +78,7 @@ groups:
 
     - id: 1.1.6
       text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--insecure-bind-address"
@@ -89,7 +89,7 @@ groups:
 
     - id: 1.1.7
       text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--insecure-port"
@@ -103,7 +103,7 @@ groups:
 
     - id: 1.1.8
       text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests: 
         bin_op: or
         test_items:
@@ -121,7 +121,7 @@ groups:
 
     - id: 1.1.9
       text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--profiling"
@@ -135,7 +135,7 @@ groups:
 
     - id: 1.1.10
       text: "Ensure that the --repair-malformed-updates argument is set to false (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--repair-malformed-updates"
@@ -149,7 +149,7 @@ groups:
 
     - id: 1.1.11
       text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -163,7 +163,7 @@ groups:
  
     - id: 1.1.12
       text: "Ensure that the admission control policy is set to AlwaysPullImages (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -177,7 +177,7 @@ groups:
  
     - id: 1.1.13
       text: "Ensure that the admission control policy is set to DenyEscalatingExec (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -191,7 +191,7 @@ groups:
 
     - id: 1.1.14
       text: "Ensure that the admission control policy is set to SecurityContextDeny (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -205,7 +205,7 @@ groups:
 
     - id: 1.1.15
       text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "admission-control"
@@ -219,7 +219,7 @@ groups:
 
     - id: 1.1.16
       text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--audit-log-path"
@@ -230,7 +230,7 @@ groups:
 
     - id: 1.1.17
       text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--audit-log-maxage"
@@ -244,7 +244,7 @@ groups:
 
     - id: 1.1.18
       text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--audit-log-maxbackup"
@@ -258,7 +258,7 @@ groups:
 
     - id: 1.1.19
       text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--audit-log-maxsize"
@@ -272,7 +272,7 @@ groups:
 
     - id: 1.1.20
       text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--authorization-mode"
@@ -286,7 +286,7 @@ groups:
 
     - id: 1.1.21
       text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--token-auth-file"
@@ -298,7 +298,7 @@ groups:
  
     - id: 1.1.22
       text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--kubelet-certificate-authority"
@@ -311,7 +311,7 @@ groups:
 
     - id: 1.1.23
       text: "Ensure that the --kubelet-client-certificate and --kubelet-clientkey arguments are set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         bin_op: and
         test_items:
@@ -327,7 +327,7 @@ groups:
 
     - id: 1.1.24
       text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--service-account-lookup"
@@ -341,7 +341,7 @@ groups:
  
     - id: 1.1.25
       text: "Ensure that the admission control policy is set to PodSecurityPolicy (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -356,7 +356,7 @@ groups:
 
     - id: 1.1.26
       text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--service-account-key-file"
@@ -367,7 +367,7 @@ groups:
 
     - id: 1.1.27
       text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         bin_op: and
         test_items:
@@ -383,7 +383,7 @@ groups:
  
     - id: 1.1.28
       text: "Ensure that the admission control policy is set to ServiceAccount (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--admission-control"
@@ -398,7 +398,7 @@ groups:
 
     - id: 1.1.29
       text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         bin_op: and
         test_items:
@@ -414,7 +414,7 @@ groups:
 
     - id: 1.1.30
       text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--client-ca-file"
@@ -426,7 +426,7 @@ groups:
 
     - id: 1.1.31
       text: "Ensure that the --etcd-cafile argument is set as appropriate (Scored)"
-      audit: "ps -C kube-apiserver -o cmd --no-headers"
+      audit: "ps -ef | grep kube-apiserver | grep -v grep"
       tests:
         test_items:
         - flag: "--etcd-cafile"
@@ -441,7 +441,7 @@ groups:
   checks:
     - id: 1.2.1
       text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -C kube-scheduler -o cmd --no-headers"
+      audit: "ps -ef | grep kube-scheduler | grep -v grep"
       tests:
         test_items:
         - flag: "--profiling"
@@ -458,7 +458,7 @@ groups:
   checks:
     - id: 1.3.1
       text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)"
-      audit: "ps -C kube-controller-manager -o cmd --no-headers"
+      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
       tests:
         test_items:
           - flag: "--terminated-pod-gc-threshold"
@@ -469,7 +469,7 @@ groups:
  
     - id: 1.3.2
       text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -C kube-controller-manager -o cmd --no-headers"
+      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
       tests:
         test_items:
         - flag: "--profiling"
@@ -483,7 +483,7 @@ groups:
  
     - id: 1.3.3
       text: "Ensure that the --insecure-experimental-approve-all-kubelet-csrs-for-group argument is not set (Scored)"
-      audit: "ps -C kube-controller-manager -o cmd --no-headers"
+      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
       tests:
         test_items:
         - flag: "--insecure-experimental-approve-all-kubelet-csrs-for-group"
@@ -495,7 +495,7 @@ groups:
 
     - id: 1.3.4
       text: "Ensure that the --use-service-account-credentials argument is set"
-      audit: "ps -C kube-controller-manager -o cmd --no-headers"
+      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
       tests:
         test_items:
         - flag: "--use-service-account-credentials"
@@ -509,7 +509,7 @@ groups:
 
     - id: 1.3.5
       text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)"
-      audit: "ps -C kube-controller-manager -o cmd --no-headers"
+      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
       tests:
         test_items:
         - flag: "--service-account-private-key-file"
@@ -520,7 +520,7 @@ groups:
 
     - id: 1.3.6
       text: "Ensure that the --root-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -C kube-controller-manager -o cmd --no-headers"
+      audit: "ps -ef | grep kube-controller-manager | grep -v grep"
       tests:
         test_items:
         - flag: "--root-ca-file"
@@ -644,7 +644,9 @@ groups:
       
     - id: 1.4.11
       text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+      # audit: ps -ef | grep etcd | grep -v grep | sed 's,.*--data-dir=\(.*\)\s*.*,\1,' | xargs stat -c %a
+      audit: "ps -ef | grep etcd | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+      # audit: xargs stat -c %a /etc/etcd
       tests:
         test_items:
         - flag: "700"
@@ -661,7 +663,7 @@ groups:
   checks:
     - id: 1.5.1
       text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--cert-file"
@@ -673,7 +675,7 @@ groups:
 
     - id: 1.5.2
       text: "Ensure that the --client-cert-auth argument is set to true (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--client-cert-auth"
@@ -689,7 +691,7 @@ groups:
 
     - id: 1.5.3
       text: "Ensure that the --auto-tls argument is not set to true (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         bin_op: or
         test_items:
@@ -707,7 +709,7 @@ groups:
 
     - id: 1.5.4
       text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--peer-cert-file"
@@ -722,7 +724,7 @@ groups:
 
     - id: 1.5.5
       text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--peer-client-cert-auth"
@@ -740,7 +742,7 @@ groups:
 
     - id: 1.5.6
       text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         bin_op: or
         test_items:
@@ -761,7 +763,7 @@ groups:
 
     - id: 1.5.7
       text: "Ensure that the --wal-dir argument is set as appropriate (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--wal-dir"
@@ -774,7 +776,7 @@ groups:
 
     - id: 1.5.8
       text: "Ensure that the --max-wals argument is set to 0 (Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--max-wals"
@@ -790,7 +792,7 @@ groups:
 
     - id: 1.5.9
       text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
-      audit: "ps -C etcd -o cmd --no-headers"
+      audit: "ps -ef | grep etcd | grep -v grep"
       tests:
         test_items:
           - flag: "--trusted-ca-file"
diff --git a/cfg/node.yaml b/cfg/node.yaml
index 01b227d..4304264 100644
--- a/cfg/node.yaml
+++ b/cfg/node.yaml
@@ -9,7 +9,7 @@ groups:
   checks:
     - id: 2.1.1
       text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--allow-privileged"
@@ -23,7 +23,7 @@ groups:
 
     - id: 2.1.2
       text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--anonymous-auth"
@@ -37,7 +37,7 @@ groups:
  
     - id: 2.1.3
       text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--authorization-mode"
@@ -51,7 +51,7 @@ groups:
    
     - id: 2.1.4
       text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--client-ca-file"
@@ -63,7 +63,7 @@ groups:
 
     - id: 2.1.5
       text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--read-only-port"
@@ -77,7 +77,7 @@ groups:
  
     - id: 2.1.6
       text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--streaming-connection-idle-timeout"
@@ -91,7 +91,7 @@ groups:
 
     - id: 2.1.7
       text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--protect-kernel-defaults"
@@ -105,7 +105,7 @@ groups:
 
     - id: 2.1.8
       text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         bin_op: or
         test_items:
@@ -122,7 +122,7 @@ groups:
 
     - id: 2.1.9
       text: "Ensure that the --keep-terminated-pod-volumes argument is set to false (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--keep-terminated-pod-volumes"
@@ -136,7 +136,7 @@ groups:
 
     - id: 2.1.10
       text: "Ensure that the --hostname-override argument is not set (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--hostname-override"
@@ -147,7 +147,7 @@ groups:
 
     - id: 2.1.11
       text: "Ensure that the --event-qps argument is set to 0 (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--event-qps"
@@ -161,7 +161,7 @@ groups:
 
     - id: 2.1.12
       text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--tls-cert-file"
@@ -176,7 +176,7 @@ groups:
 
     - id: 2.1.13
       text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
-      audit: "ps -C kubelet -o cmd --no-headers"
+      audit: "ps -ef | grep kubelet | grep -v grep"
       tests:
         test_items:
           - flag: "--cadvisor-port"

From 2119d119b008003f1080b3074c7b6155b56eec48 Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Tue, 4 Jul 2017 15:38:34 +0000
Subject: [PATCH 4/7] Restore warning messages and dont quit on verification
 error.

---
 cmd/common.go | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/cmd/common.go b/cmd/common.go
index 90cbed0..b406eda 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -55,14 +55,11 @@ func runChecks(t check.NodeType) {
 	var summary check.Summary
 	var file string
 
-	fails := verifyNodeType(t)
-	if len(fails) > 0 {
-		fmt.Fprintf(os.Stderr, "%s could not start: please resolve these issues\n", os.Args[0])
-		for _, w := range fails {
-			colorPrint(check.FAIL, w)
+	warns := verifyNodeType(t)
+	if len(warns) > 0 {
+		for _, w := range warns {
+			colorPrint(check.WARN, w)
 		}
-
-		os.Exit(1)
 	}
 
 	switch t {
@@ -117,7 +114,7 @@ func runChecks(t check.NodeType) {
 
 		fmt.Println(string(out))
 	} else {
-		prettyPrint(fails, controls, summary)
+		prettyPrint(warns, controls, summary)
 	}
 }
 
@@ -246,10 +243,7 @@ func verifyBin(binPath []string) []string {
 
 	// Run ps command
 	cmd := exec.Command("ps", "-C", binList, "-o", "cmd", "--no-headers")
-	out, err := cmd.Output()
-	if err != nil {
-		w = append(w, fmt.Sprintf("%v could not get process information\n", binPath))
-	}
+	out, _ := cmd.Output()
 
 	// Actual verification
 	for _, b := range binPath {
@@ -277,10 +271,7 @@ func verifyKubeVersion(binPath []string) []string {
 
 		// Check version
 		cmd := exec.Command(b, "--version")
-		out, err := cmd.Output()
-		if err != nil {
-			w = append(w, fmt.Sprintf("failed executing %s --version: %v\n", b, err))
-		}
+		out, _ := cmd.Output()
 
 		matched := strings.Contains(string(out), kubeVersion)
 		if !matched {

From 6ee9bedfb855a25409f3a846bee39815a3082fb5 Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Tue, 4 Jul 2017 16:53:39 +0000
Subject: [PATCH 5/7] Print verification warnings at only one point.

---
 cmd/common.go | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/cmd/common.go b/cmd/common.go
index b406eda..a2f51a5 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -56,11 +56,6 @@ func runChecks(t check.NodeType) {
 	var file string
 
 	warns := verifyNodeType(t)
-	if len(warns) > 0 {
-		for _, w := range warns {
-			colorPrint(check.WARN, w)
-		}
-	}
 
 	switch t {
 	case check.MASTER:

From b1a76360e743e8e977833865f083c1d53c065f1d Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Tue, 4 Jul 2017 17:04:31 +0000
Subject: [PATCH 6/7] Do not clutter the output with error messages from
 commands in the audit pipeline.

---
 check/check.go | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/check/check.go b/check/check.go
index afab79a..c912d98 100644
--- a/check/check.go
+++ b/check/check.go
@@ -63,7 +63,7 @@ type Check struct {
 // Run executes the audit commands specified in a check and outputs
 // the results.
 func (c *Check) Run() {
-	var out bytes.Buffer
+	var out, serr bytes.Buffer
 
 	// Check if command exists or exit with WARN.
 	for _, cmd := range c.Commands {
@@ -87,7 +87,8 @@ func (c *Check) Run() {
 	//   cmd0 err should terminate chain
 	cs := c.Commands
 
-	cs[0].Stderr = os.Stderr
+	// Initialize command pipeline
+	cs[0].Stderr = &serr
 	cs[n-1].Stdout = &out
 	i := 1
 
@@ -99,27 +100,26 @@ func (c *Check) Run() {
 			os.Exit(1)
 		}
 
-		cs[i].Stderr = os.Stderr
+		cs[i].Stderr = &serr
 		i++
 	}
 
+	// Start command pipeline
 	i = 0
 	for i < n {
-		err := cs[i].Start()
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, err)
-			os.Exit(1)
-		}
+		cs[i].Start()
+		i++
+	}
 
-		errw := cs[i].Wait()
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, errw)
-			os.Exit(1)
-		}
+	// Complete command pipeline
+	i = 0
+	for i < n {
+		cs[i].Wait()
 
 		if i < n-1 {
 			cs[i].Stdout.(io.Closer).Close()
 		}
+
 		i++
 	}
 

From dbbafd54a5c503aad754df079a8defeb759b917c Mon Sep 17 00:00:00 2001
From: Abubakr-Sadik Nii Nai Davis <dwa2pac@gmail.com>
Date: Wed, 5 Jul 2017 12:56:01 +0000
Subject: [PATCH 7/7] Do not exit on command exit, print error message to
 stderr and continue.

---
 check/check.go | 19 ++++++++++++-------
 cmd/common.go  | 12 ++++++++++--
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/check/check.go b/check/check.go
index c912d98..0e16a42 100644
--- a/check/check.go
+++ b/check/check.go
@@ -63,7 +63,7 @@ type Check struct {
 // Run executes the audit commands specified in a check and outputs
 // the results.
 func (c *Check) Run() {
-	var out, serr bytes.Buffer
+	var out bytes.Buffer
 
 	// Check if command exists or exit with WARN.
 	for _, cmd := range c.Commands {
@@ -88,7 +88,7 @@ func (c *Check) Run() {
 	cs := c.Commands
 
 	// Initialize command pipeline
-	cs[0].Stderr = &serr
+	cs[0].Stderr = os.Stderr
 	cs[n-1].Stdout = &out
 	i := 1
 
@@ -96,25 +96,30 @@ func (c *Check) Run() {
 	for i < n {
 		cs[i-1].Stdout, err = cs[i].StdinPipe()
 		if err != nil {
-			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Path, err)
-			os.Exit(1)
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, err)
 		}
 
-		cs[i].Stderr = &serr
+		cs[i].Stderr = os.Stderr
 		i++
 	}
 
 	// Start command pipeline
 	i = 0
 	for i < n {
-		cs[i].Start()
+		err := cs[i].Start()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, err)
+		}
 		i++
 	}
 
 	// Complete command pipeline
 	i = 0
 	for i < n {
-		cs[i].Wait()
+		err := cs[i].Wait()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cs[i].Args, err)
+		}
 
 		if i < n-1 {
 			cs[i].Stdout.(io.Closer).Close()
diff --git a/cmd/common.go b/cmd/common.go
index a2f51a5..93a0c7e 100644
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -238,7 +238,11 @@ func verifyBin(binPath []string) []string {
 
 	// Run ps command
 	cmd := exec.Command("ps", "-C", binList, "-o", "cmd", "--no-headers")
-	out, _ := cmd.Output()
+	cmd.Stderr = os.Stderr
+	out, err := cmd.Output()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%s: %s\n", cmd.Args, err)
+	}
 
 	// Actual verification
 	for _, b := range binPath {
@@ -266,7 +270,11 @@ func verifyKubeVersion(binPath []string) []string {
 
 		// Check version
 		cmd := exec.Command(b, "--version")
-		out, _ := cmd.Output()
+		cmd.Stderr = os.Stderr
+		out, err := cmd.Output()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "%s: %s\n", cmd.Args, err)
+		}
 
 		matched := strings.Contains(string(out), kubeVersion)
 		if !matched {