DockerHardeningCheck

Checks if the Docker container running this script has been hardened according to the recommended settings at: - For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide - For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide - For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.

python · Common Scripts

Details

ID	`DockerHardeningCheck`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	Utility

README

Checks if the Docker container running this script has been hardened according to the recommended settings located in the Docker hardening guide (Cortex XSOAR 6.13) or Docker hardening guide (Cortex XSOAR 8 Cloud) or Docker hardening guide (Cortex XSOAR 8.7 On-prem).

Script Data

Name	Description
Script Type	python3
Tags	Utility
Cortex XSOAR Version	5.0.0+

Inputs

Argument Name	Description
memory	The amount of memory to check. This is specified in bytes or append MB/GB for Mega/Giga bytes. The default is 1 GB.
memory_check	The memory check type to perform: cgroup - check memory cgroup configuration, allocate - try allocating actual memory and verify that the allocation fails. Note the allocate test on some configurations may cause the container to be killed by the linux memory manager and the whole test will then time out.
pids	The maximum number of PIDs to check.
fds_soft	The soft file descriptor limit to check.
fds_hard	The hard file descriptor limit to check.
cpus	The number of CPUs limit to check.
network_check	The network check to perform. cloud_metadata - check that access is blocked to cloud metadata server, host_machine - check that access is blocked to the host machine on the default gateway IP, all - perform all network tests.

Outputs

There are no outputs for this script.

Notes

Network Host Check: The network host check only checks available access on the default gateway’s IP using an https request to port 443. There still may be access available to the host network either on a different IP or port and this check will not detect it.

Source

DockerHardeningCheck.py DockerHardeningCheck_test.py DockerHardeningCheck.yml

Download History Raw

import ipaddress
import os

import requests_mock
from DockerHardeningCheck import (
    CLOUD_METADATA_URL,
    check_fd_limits,
    check_network,
    check_pids,
    get_default_gateway,
    mem_size_to_bytes,
)
from pytest_mock import MockerFixture

# NOTE: Should be fixed in future versions (related to CIAC-11476)
# def test_check_memory():
#     if os.getenv("GITHUB_ACTIONS"):
#         pytest.skip("skipping as in GITHUB ACTIONS this fails")
#     assert 'memory cgroup configuration' in check_memory("10m", "cgroup")


def test_mem_size():
    assert mem_size_to_bytes("1g") == (1024 * 1024 * 1024)
    assert mem_size_to_bytes("512m") == (512 * 1024 * 1024)


def test_pids():
    assert check_pids(10)


def test_fd_limits():
    assert check_fd_limits(100, 200)


def test_get_default_gateway():
    res = get_default_gateway()
    assert res
    # verify we have an ip
    assert ipaddress.ip_address(res)


def test_check_network(requests_mock: requests_mock.Mocker, mocker: MockerFixture):
    default_gateway_mock = mocker.patch("DockerHardeningCheck.get_default_gateway", return_value="172.12.0.1")
    requests_mock.get(CLOUD_METADATA_URL, text="access is open", headers={"test": "mock header"})
    requests_mock.get("https://172.12.0.1/", text="local access is open", headers={"test": "mock local header"})
    res = check_network("all")
    assert default_gateway_mock.call_count == 1
    assert CLOUD_METADATA_URL in res
    assert "mock header" in res
    assert "mock local header" in res


def test_podman(mocker):
    import DockerHardeningCheck

    mocker.patch.dict(os.environ, {"container": "podman"})
    mock_return_error = mocker.patch("DockerHardeningCheck.return_error")

    DockerHardeningCheck.main()

    mock_return_error.assert_called_once_with("This script only works in Docker containers. Podman is not supported")