arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-13 19:29:02 +00:00
Code Issues Releases Wiki Activity

Better detection of running executables

Browse Source
This commit is contained in:
Liz Rice 2017-08-31 16:01:31 +01:00
parent d637d8714a
commit 8380ad1ef3
2 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
cmd/util.go
View File

@ -159,14 +159,14 @@ func verifyBin(bin string) bool {
proc := strings.Fields(bin)[0]
out := psFunc(proc)
if !strings.Contains(out, bin) {
return false
}
// Make sure we're not just matching on a partial word (e.g. if we're looking for apiserver, don't match on kube-apiserver)
// This will give a false positive for matching "one two" against "zero one two-x" but it will do for now
for _, f := range strings.Fields(out) {
if f == proc {
// There could be multiple lines in the ps output
// The binary needs to be the first word in the ps output, except that it could be preceded by a path
// e.g. /usr/bin/kubelet is a match for kubelet
// but apiserver is not a match for kube-apiserver
reFirstWord := regexp.MustCompile(`^(\S*\/)*` + bin)
lines := strings.Split(out, "\n")
for _, l := range lines {
if reFirstWord.Match([]byte(l)) {
return true
}
}

5
cmd/util_test.go
View File

@ -108,6 +108,11 @@ func TestVerifyBin(t *testing.T) {
{proc: "cmd", psOut: "cmd param1 param2", exp: true},
{proc: "cmd param", psOut: "cmd param1 param2", exp: true},
{proc: "cmd param", psOut: "cmd", exp: false},
{proc: "cmd", psOut: "cmd x \ncmd y", exp: true},
{proc: "cmd y", psOut: "cmd x \ncmd y", exp: true},
{proc: "cmd", psOut: "/usr/bin/cmd", exp: true},
{proc: "cmd", psOut: "kube-cmd", exp: false},
{proc: "cmd", psOut: "/usr/bin/kube-cmd", exp: false},
}
psFunc = fakeps