mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-12-23 15:18:07 +00:00
b86dd92c91
* issue #348: replace everywhere get<Thing>Files with getFiles
345 lines
9.2 KiB
Go
345 lines
9.2 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"regexp"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/aquasecurity/kube-bench/check"
|
|
"github.com/fatih/color"
|
|
"github.com/golang/glog"
|
|
"github.com/spf13/viper"
|
|
)
|
|
|
|
var (
|
|
// Print colors
|
|
colors = map[check.State]*color.Color{
|
|
check.PASS: color.New(color.FgGreen),
|
|
check.FAIL: color.New(color.FgRed),
|
|
check.WARN: color.New(color.FgYellow),
|
|
check.INFO: color.New(color.FgBlue),
|
|
}
|
|
)
|
|
|
|
var psFunc func(string) string
|
|
var statFunc func(string) (os.FileInfo, error)
|
|
var TypeMap = map[string][]string{
|
|
"ca": []string{"cafile", "defaultcafile"},
|
|
"kubeconfig": []string{"kubeconfig", "defaultkubeconfig"},
|
|
"service": []string{"svc", "defaultsvc"},
|
|
"config": []string{"confs", "defaultconf"},
|
|
}
|
|
|
|
func init() {
|
|
psFunc = ps
|
|
statFunc = os.Stat
|
|
}
|
|
|
|
func exitWithError(err error) {
|
|
fmt.Fprintf(os.Stderr, "\n%v\n", err)
|
|
// flush before exit non-zero
|
|
glog.Flush()
|
|
os.Exit(1)
|
|
}
|
|
|
|
func continueWithError(err error, msg string) string {
|
|
if err != nil {
|
|
glog.V(2).Info(err)
|
|
}
|
|
|
|
if msg != "" {
|
|
fmt.Fprintf(os.Stderr, "%s\n", msg)
|
|
}
|
|
|
|
return ""
|
|
}
|
|
|
|
func cleanIDs(list string) map[string]bool {
|
|
list = strings.Trim(list, ",")
|
|
ids := strings.Split(list, ",")
|
|
|
|
set := make(map[string]bool)
|
|
|
|
for _, id := range ids {
|
|
id = strings.Trim(id, " ")
|
|
set[id] = true
|
|
}
|
|
|
|
return set
|
|
}
|
|
|
|
// ps execs out to the ps command; it's separated into a function so we can write tests
|
|
func ps(proc string) string {
|
|
// TODO: truncate proc to 15 chars
|
|
// See https://github.com/aquasecurity/kube-bench/issues/328#issuecomment-506813344
|
|
cmd := exec.Command("ps", "-C", proc, "-o", "cmd", "--no-headers")
|
|
out, err := cmd.Output()
|
|
if err != nil {
|
|
continueWithError(fmt.Errorf("%s: %s", cmd.Args, err), "")
|
|
}
|
|
|
|
return string(out)
|
|
}
|
|
|
|
// getBinaries finds which of the set of candidate executables are running.
|
|
// It returns an error if one mandatory executable is not running.
|
|
func getBinaries(v *viper.Viper) (map[string]string, error) {
|
|
binmap := make(map[string]string)
|
|
|
|
for _, component := range v.GetStringSlice("components") {
|
|
s := v.Sub(component)
|
|
if s == nil {
|
|
continue
|
|
}
|
|
|
|
optional := s.GetBool("optional")
|
|
bins := s.GetStringSlice("bins")
|
|
if len(bins) > 0 {
|
|
bin, err := findExecutable(bins)
|
|
if err != nil && !optional {
|
|
return nil, fmt.Errorf("need %s executable but none of the candidates are running", component)
|
|
}
|
|
|
|
// Default the executable name that we'll substitute to the name of the component
|
|
if bin == "" {
|
|
bin = component
|
|
glog.V(2).Info(fmt.Sprintf("Component %s not running", component))
|
|
} else {
|
|
glog.V(2).Info(fmt.Sprintf("Component %s uses running binary %s", component, bin))
|
|
}
|
|
binmap[component] = bin
|
|
}
|
|
}
|
|
|
|
return binmap, nil
|
|
}
|
|
|
|
// getConfigFilePath locates the config files we should be using based on either the specified
|
|
// version, or the running version of kubernetes if not specified
|
|
func getConfigFilePath(specifiedVersion string, runningVersion string, filename string) (path string, err error) {
|
|
var fileVersion string
|
|
|
|
if specifiedVersion != "" {
|
|
fileVersion = specifiedVersion
|
|
} else {
|
|
fileVersion = runningVersion
|
|
}
|
|
|
|
glog.V(2).Info(fmt.Sprintf("Looking for config for version %s", fileVersion))
|
|
|
|
for {
|
|
path = filepath.Join(cfgDir, fileVersion)
|
|
file := filepath.Join(path, string(filename))
|
|
glog.V(2).Info(fmt.Sprintf("Looking for config file: %s\n", file))
|
|
|
|
if _, err = os.Stat(file); !os.IsNotExist(err) {
|
|
if specifiedVersion == "" && fileVersion != runningVersion {
|
|
glog.V(1).Info(fmt.Sprintf("No test file found for %s - using tests for Kubernetes %s\n", runningVersion, fileVersion))
|
|
}
|
|
return path, nil
|
|
}
|
|
|
|
// If we were given an explicit version to look for, don't look for any others
|
|
if specifiedVersion != "" {
|
|
return "", err
|
|
}
|
|
|
|
fileVersion = decrementVersion(fileVersion)
|
|
if fileVersion == "" {
|
|
return "", fmt.Errorf("no test files found <= runningVersion")
|
|
}
|
|
}
|
|
}
|
|
|
|
// decrementVersion decrements the version number
|
|
// We want to decrement individually even through versions where we don't supply test files
|
|
// just in case someone wants to specify their own test files for that version
|
|
func decrementVersion(version string) string {
|
|
split := strings.Split(version, ".")
|
|
minor, err := strconv.Atoi(split[1])
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
if minor <= 1 {
|
|
return ""
|
|
}
|
|
split[1] = strconv.Itoa(minor - 1)
|
|
return strings.Join(split, ".")
|
|
}
|
|
|
|
// getFiles finds which of the set of candidate files exist
|
|
func getFiles(v *viper.Viper, fileType string) map[string]string {
|
|
filemap := make(map[string]string)
|
|
mainOpt := TypeMap[fileType][0]
|
|
defaultOpt := TypeMap[fileType][1]
|
|
|
|
for _, component := range v.GetStringSlice("components") {
|
|
s := v.Sub(component)
|
|
if s == nil {
|
|
continue
|
|
}
|
|
|
|
// See if any of the candidate files exist
|
|
file := findConfigFile(s.GetStringSlice(mainOpt))
|
|
if file == "" {
|
|
if s.IsSet(defaultOpt) {
|
|
file = s.GetString(defaultOpt)
|
|
glog.V(2).Info(fmt.Sprintf("Using default %s file name '%s' for component %s", fileType, file, component))
|
|
} else {
|
|
// Default the file name that we'll substitute to the name of the component
|
|
glog.V(2).Info(fmt.Sprintf("Missing %s file for %s", fileType, component))
|
|
file = component
|
|
}
|
|
} else {
|
|
glog.V(2).Info(fmt.Sprintf("Component %s uses %s file '%s'", component, fileType, file))
|
|
}
|
|
|
|
filemap[component] = file
|
|
}
|
|
|
|
return filemap
|
|
}
|
|
|
|
// verifyBin checks that the binary specified is running
|
|
func verifyBin(bin string) bool {
|
|
|
|
// Strip any quotes
|
|
bin = strings.Trim(bin, "'\"")
|
|
|
|
// bin could consist of more than one word
|
|
// We'll search for running processes with the first word, and then check the whole
|
|
// proc as supplied is included in the results
|
|
proc := strings.Fields(bin)[0]
|
|
out := psFunc(proc)
|
|
|
|
// There could be multiple lines in the ps output
|
|
// The binary needs to be the first word in the ps output, except that it could be preceded by a path
|
|
// e.g. /usr/bin/kubelet is a match for kubelet
|
|
// but apiserver is not a match for kube-apiserver
|
|
reFirstWord := regexp.MustCompile(`^(\S*\/)*` + bin)
|
|
lines := strings.Split(out, "\n")
|
|
for _, l := range lines {
|
|
if reFirstWord.Match([]byte(l)) {
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// fundConfigFile looks through a list of possible config files and finds the first one that exists
|
|
func findConfigFile(candidates []string) string {
|
|
for _, c := range candidates {
|
|
_, err := statFunc(c)
|
|
if err == nil {
|
|
return c
|
|
}
|
|
if !os.IsNotExist(err) {
|
|
exitWithError(fmt.Errorf("error looking for file %s: %v", c, err))
|
|
}
|
|
}
|
|
|
|
return ""
|
|
}
|
|
|
|
// findExecutable looks through a list of possible executable names and finds the first one that's running
|
|
func findExecutable(candidates []string) (string, error) {
|
|
for _, c := range candidates {
|
|
if verifyBin(c) {
|
|
return c, nil
|
|
}
|
|
glog.V(1).Info(fmt.Sprintf("executable '%s' not running", c))
|
|
}
|
|
|
|
return "", fmt.Errorf("no candidates running")
|
|
}
|
|
|
|
func multiWordReplace(s string, subname string, sub string) string {
|
|
f := strings.Fields(sub)
|
|
if len(f) > 1 {
|
|
sub = "'" + sub + "'"
|
|
}
|
|
|
|
return strings.Replace(s, subname, sub, -1)
|
|
}
|
|
|
|
func getKubeVersion() (string, error) {
|
|
// These executables might not be on the user's path.
|
|
_, err := exec.LookPath("kubectl")
|
|
|
|
if err != nil {
|
|
_, err = exec.LookPath("kubelet")
|
|
if err != nil {
|
|
// Search for the kubelet binary all over the filesystem and run the first match to get the kubernetes version
|
|
cmd := exec.Command("/bin/sh", "-c", "`find / -type f -executable -name kubelet 2>/dev/null | grep -m1 .` --version")
|
|
out, err := cmd.CombinedOutput()
|
|
if err == nil {
|
|
return getVersionFromKubeletOutput(string(out)), nil
|
|
}
|
|
return "", fmt.Errorf("need kubectl or kubelet binaries to get kubernetes version")
|
|
}
|
|
return getKubeVersionFromKubelet(), nil
|
|
}
|
|
|
|
return getKubeVersionFromKubectl(), nil
|
|
}
|
|
|
|
func getKubeVersionFromKubectl() string {
|
|
cmd := exec.Command("kubectl", "version", "--short")
|
|
out, err := cmd.CombinedOutput()
|
|
if err != nil {
|
|
continueWithError(fmt.Errorf("%s", out), "")
|
|
}
|
|
|
|
return getVersionFromKubectlOutput(string(out))
|
|
}
|
|
|
|
func getKubeVersionFromKubelet() string {
|
|
cmd := exec.Command("kubelet", "--version")
|
|
out, err := cmd.CombinedOutput()
|
|
|
|
if err != nil {
|
|
continueWithError(fmt.Errorf("%s", out), "")
|
|
}
|
|
|
|
return getVersionFromKubeletOutput(string(out))
|
|
}
|
|
|
|
func getVersionFromKubectlOutput(s string) string {
|
|
serverVersionRe := regexp.MustCompile(`Server Version: v(\d+.\d+)`)
|
|
subs := serverVersionRe.FindStringSubmatch(s)
|
|
if len(subs) < 2 {
|
|
glog.V(1).Info(fmt.Sprintf("Unable to get Kubernetes version from kubectl, using default version: %s", defaultKubeVersion))
|
|
return defaultKubeVersion
|
|
}
|
|
return subs[1]
|
|
}
|
|
|
|
func getVersionFromKubeletOutput(s string) string {
|
|
serverVersionRe := regexp.MustCompile(`Kubernetes v(\d+.\d+)`)
|
|
subs := serverVersionRe.FindStringSubmatch(s)
|
|
if len(subs) < 2 {
|
|
glog.V(1).Info(fmt.Sprintf("Unable to get Kubernetes version from kubelet, using default version: %s", defaultKubeVersion))
|
|
return defaultKubeVersion
|
|
}
|
|
return subs[1]
|
|
}
|
|
|
|
func makeSubstitutions(s string, ext string, m map[string]string) string {
|
|
for k, v := range m {
|
|
subst := "$" + k + ext
|
|
if v == "" {
|
|
glog.V(2).Info(fmt.Sprintf("No subsitution for '%s'\n", subst))
|
|
continue
|
|
}
|
|
glog.V(2).Info(fmt.Sprintf("Substituting %s with '%s'\n", subst, v))
|
|
s = multiWordReplace(s, subst, v)
|
|
}
|
|
|
|
return s
|
|
}
|