gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-23 07:29:00 -08:00
Code Issues Packages Projects Releases Wiki Activity

feat(misconf): Use updated terminology for misconfiguration checks (#6476)

Browse Source 
Signed-off-by: Simar <simar@linux.com>
This commit is contained in:
simar7
2024-05-02 12:16:17 -06:00
committed by GitHub
parent cdee7030ac
commit 37da98df45
52 changed files with 1074 additions and 398 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/configuration/cache.md
View File

@@ -70,7 +70,7 @@ $ trivy server --cache-backend redis://localhost:6379 \
[trivy-db]: ./db.md#vulnerability-database [trivy-db]: ./db.md#vulnerability-database
[trivy-java-db]: ./db.md#java-index-database [trivy-java-db]: ./db.md#java-index-database
[misconf-policies]: ../scanner/misconfiguration/policy/builtin.md [misconf-policies]: ../scanner/misconfiguration/check/builtin.md
[^1]: Downloaded when scanning for vulnerabilities [^1]: Downloaded when scanning for vulnerabilities
[^2]: Downloaded when scanning `jar/war/par/ear` files [^2]: Downloaded when scanning `jar/war/par/ear` files

2
docs/docs/coverage/iac/helm.md
View File

@@ -11,7 +11,7 @@ The following scanners are supported.
Trivy recursively searches directories and scans all found Helm files. Trivy recursively searches directories and scans all found Helm files.
It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
See [here](../../scanner/misconfiguration/policy/builtin.md) for more details on the built-in policies. See [here](../../scanner/misconfiguration/check/builtin.md) for more details on the built-in policies.
### Value overrides ### Value overrides
There are a number of options for overriding values in Helm charts. There are a number of options for overriding values in Helm charts.

12
docs/docs/references/configuration/cli/trivy_aws.md
View File

@@ -69,9 +69,11 @@ trivy aws [flags]
--account string The AWS account to scan. It's useful to specify this when reviewing cached results for multiple accounts. --account string The AWS account to scan. It's useful to specify this when reviewing cached results for multiple accounts.
--arn string The AWS ARN to show results for. Useful to filter results once a scan is cached. --arn string The AWS ARN to show results for. Useful to filter results once a scan is cached.
--cf-params strings specify paths to override the CloudFormation parameters files --cf-params strings specify paths to override the CloudFormation parameters files
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--compliance string compliance report to generate (aws-cis-1.2,aws-cis-1.4) --compliance string compliance report to generate (aws-cis-1.2,aws-cis-1.4)
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages
--endpoint string AWS Endpoint override --endpoint string AWS Endpoint override
--exit-code int specify exit code when any security issues are found --exit-code int specify exit code when any security issues are found
@@ -91,14 +93,12 @@ trivy aws [flags]
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot]) --misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
-o, --output string output file name -o, --output string output file name
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--region string AWS Region to scan --region string AWS Region to scan
--report string specify a report format for the output (all,summary) (default "all") --report string specify a report format for the output (all,summary) (default "all")
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--service strings Only scan AWS Service(s) specified with this flag. Can specify multiple services using --service A --service B etc. --service strings Only scan AWS Service(s) specified with this flag. Can specify multiple services using --service A --service B etc.
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--skip-policy-update skip fetching rego policy updates --skip-check-update skip fetching rego check updates
--skip-service strings Skip selected AWS Service(s) specified with this flag. Can specify multiple services using --skip-service A --skip-service B etc. --skip-service strings Skip selected AWS Service(s) specified with this flag. Can specify multiple services using --skip-service A --skip-service B etc.
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules

12
docs/docs/references/configuration/cli/trivy_config.md
View File

@@ -12,10 +12,12 @@ trivy config [flags] DIR
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--cf-params strings specify paths to override the CloudFormation parameters files --cf-params strings specify paths to override the CloudFormation parameters files
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--compliance string compliance report to generate --compliance string compliance report to generate
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--enable-modules strings [EXPERIMENTAL] module names to enable --enable-modules strings [EXPERIMENTAL] module names to enable
--exit-code int specify exit code when any security issues are found --exit-code int specify exit code when any security issues are found
--file-patterns strings specify config file patterns --file-patterns strings specify config file patterns
@@ -36,19 +38,17 @@ trivy config [flags] DIR
-o, --output string output file name -o, --output string output file name
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token --registry-token string registry token
--report string specify a compliance report format for the output (all,summary) (default "all") --report string specify a compliance report format for the output (all,summary) (default "all")
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--skip-check-update skip fetching rego check updates
--skip-dirs strings specify the directories or glob patterns to skip --skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip --skip-files strings specify the files or glob patterns to skip
--skip-policy-update skip fetching rego policy updates
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
--tf-vars strings specify paths to override the Terraform tfvars files --tf-vars strings specify paths to override the Terraform tfvars files

12
docs/docs/references/configuration/cli/trivy_filesystem.md
View File

@@ -22,10 +22,12 @@ trivy filesystem [flags] PATH
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--cf-params strings specify paths to override the CloudFormation parameters files --cf-params strings specify paths to override the CloudFormation parameters files
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--compliance string compliance report to generate --compliance string compliance report to generate
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--custom-headers strings custom headers in client mode --custom-headers strings custom headers in client mode
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2") --db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
--dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages
@@ -61,8 +63,6 @@ trivy filesystem [flags] PATH
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5) --parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend
@@ -71,18 +71,18 @@ trivy filesystem [flags] PATH
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev") --rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--report string specify a compliance report format for the output (all,summary) (default "all") --report string specify a compliance report format for the output (all,summary) (default "all")
--reset remove all caches and database --reset remove all caches and database
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret]) --scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml") --secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")
--server string server address in client mode --server string server address in client mode
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities --show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities
--skip-check-update skip fetching rego check updates
--skip-db-update skip updating vulnerability database --skip-db-update skip updating vulnerability database
--skip-dirs strings specify the directories or glob patterns to skip --skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip --skip-files strings specify the files or glob patterns to skip
--skip-java-db-update skip updating Java index database --skip-java-db-update skip updating Java index database
--skip-policy-update skip fetching rego policy updates
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
--tf-vars strings specify paths to override the Terraform tfvars files --tf-vars strings specify paths to override the Terraform tfvars files

12
docs/docs/references/configuration/cli/trivy_image.md
View File

@@ -36,10 +36,12 @@ trivy image [flags] IMAGE_NAME
``` ```
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--compliance string compliance report to generate (docker-cis) --compliance string compliance report to generate (docker-cis)
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--custom-headers strings custom headers in client mode --custom-headers strings custom headers in client mode
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2") --db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
--dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages
@@ -81,8 +83,6 @@ trivy image [flags] IMAGE_NAME
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--platform string set platform in the form os/arch if image is multi-platform capable --platform string set platform in the form os/arch if image is multi-platform capable
--podman-host string unix podman socket path to use for podman scanning --podman-host string unix podman socket path to use for podman scanning
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend
@@ -92,18 +92,18 @@ trivy image [flags] IMAGE_NAME
--removed-pkgs detect vulnerabilities of removed packages (only for Alpine) --removed-pkgs detect vulnerabilities of removed packages (only for Alpine)
--report string specify a format for the compliance report. (all,summary) (default "summary") --report string specify a format for the compliance report. (all,summary) (default "summary")
--reset remove all caches and database --reset remove all caches and database
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret]) --scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml") --secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")
--server string server address in client mode --server string server address in client mode
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities --show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities
--skip-check-update skip fetching rego check updates
--skip-db-update skip updating vulnerability database --skip-db-update skip updating vulnerability database
--skip-dirs strings specify the directories or glob patterns to skip --skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip --skip-files strings specify the files or glob patterns to skip
--skip-java-db-update skip updating Java index database --skip-java-db-update skip updating Java index database
--skip-policy-update skip fetching rego policy updates
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
--token string for authentication in client/server mode --token string for authentication in client/server mode

12
docs/docs/references/configuration/cli/trivy_kubernetes.md
View File

@@ -32,10 +32,12 @@ trivy kubernetes [flags] [CONTEXT]
--burst int specify the maximum burst for throttle (default 10) --burst int specify the maximum burst for throttle (default 10)
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted) --compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted)
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2") --db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
--dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages
--disable-node-collector When the flag is activated, the node-collector job will not be executed, thus skipping misconfiguration findings on the node. --disable-node-collector When the flag is activated, the node-collector job will not be executed, thus skipping misconfiguration findings on the node.
@@ -76,8 +78,6 @@ trivy kubernetes [flags] [CONTEXT]
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5) --parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--qps float specify the maximum QPS to the master from this client (default 5) --qps float specify the maximum QPS to the master from this client (default 5)
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
@@ -87,18 +87,18 @@ trivy kubernetes [flags] [CONTEXT]
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev") --rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--report string specify a report format for the output (all,summary) (default "all") --report string specify a report format for the output (all,summary) (default "all")
--reset remove all caches and database --reset remove all caches and database
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,rbac) (default [vuln,misconfig,secret,rbac]) --scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,rbac) (default [vuln,misconfig,secret,rbac])
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml") --secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities --show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities
--skip-check-update skip fetching rego check updates
--skip-db-update skip updating vulnerability database --skip-db-update skip updating vulnerability database
--skip-dirs strings specify the directories or glob patterns to skip --skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip --skip-files strings specify the files or glob patterns to skip
--skip-images skip the downloading and scanning of images (vulnerabilities and secrets) in the cluster resources --skip-images skip the downloading and scanning of images (vulnerabilities and secrets) in the cluster resources
--skip-java-db-update skip updating Java index database --skip-java-db-update skip updating Java index database
--skip-policy-update skip fetching rego policy updates
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
--tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule) --tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule)

12
docs/docs/references/configuration/cli/trivy_repository.md
View File

@@ -22,10 +22,12 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--cf-params strings specify paths to override the CloudFormation parameters files --cf-params strings specify paths to override the CloudFormation parameters files
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--commit string pass the commit hash to be scanned --commit string pass the commit hash to be scanned
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--custom-headers strings custom headers in client mode --custom-headers strings custom headers in client mode
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2") --db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
--dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages
@@ -61,8 +63,6 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5) --parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend
@@ -70,18 +70,18 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
--registry-token string registry token --registry-token string registry token
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev") --rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--reset remove all caches and database --reset remove all caches and database
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret]) --scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml") --secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")
--server string server address in client mode --server string server address in client mode
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities --show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities
--skip-check-update skip fetching rego check updates
--skip-db-update skip updating vulnerability database --skip-db-update skip updating vulnerability database
--skip-dirs strings specify the directories or glob patterns to skip --skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip --skip-files strings specify the files or glob patterns to skip
--skip-java-db-update skip updating Java index database --skip-java-db-update skip updating Java index database
--skip-policy-update skip fetching rego policy updates
--tag string pass the tag name to be scanned --tag string pass the tag name to be scanned
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules

12
docs/docs/references/configuration/cli/trivy_rootfs.md
View File

@@ -25,9 +25,11 @@ trivy rootfs [flags] ROOTDIR
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--cf-params strings specify paths to override the CloudFormation parameters files --cf-params strings specify paths to override the CloudFormation parameters files
--check-namespaces strings Rego namespaces
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--config-data strings specify paths from which data for the Rego policies will be recursively loaded --config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
--config-policy strings specify the paths to the Rego policy files or to the directories containing them, applying config files --config-data strings specify paths from which data for the Rego checks will be recursively loaded
--custom-headers strings custom headers in client mode --custom-headers strings custom headers in client mode
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2") --db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
--dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages --dependency-tree [EXPERIMENTAL] show dependency origin tree of vulnerable packages
@@ -63,8 +65,6 @@ trivy rootfs [flags] ROOTDIR
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5) --parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons. --password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend
@@ -72,18 +72,18 @@ trivy rootfs [flags] ROOTDIR
--registry-token string registry token --registry-token string registry token
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev") --rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--reset remove all caches and database --reset remove all caches and database
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret]) --scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml") --secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")
--server string server address in client mode --server string server address in client mode
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL]) -s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
--show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities --show-suppressed [EXPERIMENTAL] show suppressed vulnerabilities
--skip-check-update skip fetching rego check updates
--skip-db-update skip updating vulnerability database --skip-db-update skip updating vulnerability database
--skip-dirs strings specify the directories or glob patterns to skip --skip-dirs strings specify the directories or glob patterns to skip
--skip-files strings specify the files or glob patterns to skip --skip-files strings specify the files or glob patterns to skip
--skip-java-db-update skip updating Java index database --skip-java-db-update skip updating Java index database
--skip-policy-update skip fetching rego policy updates
-t, --template string output template -t, --template string output template
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules --tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
--tf-vars strings specify paths to override the Terraform tfvars files --tf-vars strings specify paths to override the Terraform tfvars files

4
docs/docs/references/configuration/cli/trivy_vm.md
View File

@@ -23,6 +23,7 @@ trivy vm [flags] VM_IMAGE
--aws-region string AWS region to scan --aws-region string AWS region to scan
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs") --cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend --cache-ttl duration cache TTL when using redis as cache backend
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
--clear-cache clear image caches without scanning --clear-cache clear image caches without scanning
--compliance string compliance report to generate --compliance string compliance report to generate
--custom-headers strings custom headers in client mode --custom-headers strings custom headers in client mode
@@ -56,14 +57,13 @@ trivy vm [flags] VM_IMAGE
-o, --output string output file name -o, --output string output file name
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments --output-plugin-arg string [EXPERIMENTAL] output plugin arguments
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5) --parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--redis-ca string redis ca file location, if using redis as cache backend --redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend --redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend --redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend --redis-tls enable redis TLS with public certificates, if using redis as cache backend
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev") --rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--reset remove all caches and database --reset remove all caches and database
--reset-policy-bundle remove policy bundle --reset-checks-bundle remove checks bundle
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor) --sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret]) --scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml") --secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

21
docs/docs/scanner/misconfiguration/check/builtin.md Normal file
View File

@@ -0,0 +1,21 @@
# Built-in Checks
## Check Sources
Built-in checks are mainly written in [Rego][rego] and Go.
Those checks are managed under [trivy-checks repository][trivy-checks].
See [here](../../../coverage/iac/index.md) for the list of supported config types.
For suggestions or issues regarding policy content, please open an issue under the [trivy-checks][trivy-checks] repository.
## Check Distribution
Trivy checks are distributed as an OPA bundle on [GitHub Container Registry][ghcr] (GHCR).
When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache.
Those checks are then loaded into Trivy OPA engine and used for detecting misconfigurations.
If Trivy is unable to pull down newer checks, it will use the embedded set of checks as a fallback. This is also the case in air-gap environments where `--skip-policy-update` might be passed.
## Update Interval
Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.
[rego]: https://www.openpolicyagent.org/docs/latest/policy-language/
[trivy-checks]: https://github.com/aquasecurity/trivy-checks
[ghcr]: https://github.com/aquasecurity/trivy-checks/pkgs/container/trivy-checks

14
docs/docs/scanner/misconfiguration/policy/exceptions.md → docs/docs/scanner/misconfiguration/check/exceptions.md
View File

@@ -28,8 +28,6 @@ The `exception` rule must be defined under `namespace.exceptions`.
This example exempts all built-in policies for Kubernetes. This example exempts all built-in policies for Kubernetes.
For more details, see [an example][ns-example].
## Rule-based exceptions ## Rule-based exceptions
There are some cases where you need more flexibility and granularity in defining which cases to exempt. There are some cases where you need more flexibility and granularity in defining which cases to exempt.
Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them. Rule-based exceptions lets you granularly choose which individual rules to exempt, while also declaring under which conditions to exempt them.
@@ -87,12 +85,8 @@ If you want to apply rule-based exceptions to built-in policies, you have to def
} }
``` ```
This exception is applied to [KSV012][ksv012] in trivy-policies. This exception is applied to [KSV012][ksv012] in trivy-checks.
You can get the package names in the [trivy-policies repository][trivy-policies] or the JSON output from Trivy. You can get the package names in the [trivy-checks repository][trivy-checks] or the JSON output from Trivy.
For more details, see [an example][rule-example]. [ksv012]: https://github.com/aquasecurity/trivy-checks/blob/f36a5b732c4b1293a720c40baab0a7c106ea455e/checks/kubernetes/pss/restricted/3_runs_as_root.rego
[trivy-checks]: https://github.com/aquasecurity/trivy-checks/
[ns-example]: https://github.com/aquasecurity/trivy/tree/{{ git.commit }}/examples/misconf/namespace-exception
[rule-example]: https://github.com/aquasecurity/trivy/tree/{{ git.commit }}/examples/misconf/rule-exception
[ksv012]: https://github.com/aquasecurity/trivy-policies/blob/main/rules/kubernetes/policies/pss/restricted/3_runs_as_root.rego
[trivy-policies]: https://github.com/aquasecurity/trivy-policies/

4
docs/docs/scanner/misconfiguration/custom/testing.md
View File

@@ -22,7 +22,7 @@ For more details, see [Policy Testing][opa-testing].
} }
``` ```
To write tests for custom policies, you can refer to existing tests under [trivy-policies][trivy-policies]. To write tests for custom policies, you can refer to existing tests under [trivy-checks][trivy-checks].
## Go testing ## Go testing
[Fanal][fanal] which is a core library of Trivy can be imported as a Go library. [Fanal][fanal] which is a core library of Trivy can be imported as a Go library.
@@ -85,6 +85,6 @@ The following example stores allowed and denied configuration files in a directo
`Dockerfile.allowed` has one successful result in `Successes`, while `Dockerfile.denied` has one failure result in `Failures`. `Dockerfile.allowed` has one successful result in `Successes`, while `Dockerfile.denied` has one failure result in `Failures`.
[opa-testing]: https://www.openpolicyagent.org/docs/latest/policy-testing/ [opa-testing]: https://www.openpolicyagent.org/docs/latest/policy-testing/
[defsec]: https://github.com/aquasecurity/trivy-policies/tree/main [defsec]: https://github.com/aquasecurity/trivy-checks/tree/main
[table]: https://github.com/golang/go/wiki/TableDrivenTests [table]: https://github.com/golang/go/wiki/TableDrivenTests
[fanal]: https://github.com/aquasecurity/fanal [fanal]: https://github.com/aquasecurity/fanal

24
docs/docs/scanner/misconfiguration/policy/builtin.md
View File

@@ -1,24 +0,0 @@
# Built-in Policies
## Policy Sources
Built-in policies are mainly written in [Rego][rego] and Go.
Those policies are managed under [trivy-policies repository][trivy-policies].
See [here](../../../coverage/iac/index.md) for the list of supported config types.
For suggestions or issues regarding policy content, please open an issue under the [trivy-policies][trivy-policies] repository.
## Policy Distribution
Trivy policies are distributed as an OPA bundle on [GitHub Container Registry][ghcr] (GHCR).
When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache.
Those policies are then loaded into Trivy OPA engine and used for detecting misconfigurations.
If Trivy is unable to pull down newer policies, it will use the embedded set of policies as a fallback. This is also the case in air-gap environments where `--skip-policy-update` might be passed.
## Update Interval
Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.
[rego]: https://www.openpolicyagent.org/docs/latest/policy-language/
[kubernetes-policies]: https://github.com/aquasecurity/trivy-policies/tree/main/rules/kubernetes/policies
[docker-policies]: https://github.com/aquasecurity/trivy-policies/tree/main/rules/docker/policies
[trivy-policies]: https://github.com/aquasecurity/trivy-policies
[ghcr]: https://github.com/aquasecurity/trivy-policies/pkgs/container/trivy-policies

2
docs/tutorials/misconfiguration/custom-checks.md
View File

@@ -108,4 +108,4 @@ Please replace:
* [Rego provides a long list of courses](https://academy.styra.com/collections) that can be useful in writing more complex checks * [Rego provides a long list of courses](https://academy.styra.com/collections) that can be useful in writing more complex checks
* [The Rego documentation provides detailed information on the different types, iterations etc.](https://www.openpolicyagent.org/docs/latest/) * [The Rego documentation provides detailed information on the different types, iterations etc.](https://www.openpolicyagent.org/docs/latest/)
* Have a look at the [built-in checks](https://github.com/aquasecurity/trivy-policies/tree/main/checks) for Trivy for inspiration on how to write custom checks. * Have a look at the [built-in checks](https://github.com/aquasecurity/trivy-checks/tree/main/checks) for Trivy for inspiration on how to write custom checks.

10
go.mod
View File

@@ -21,13 +21,13 @@ require (
github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492
github.com/aquasecurity/loading v0.0.5 github.com/aquasecurity/loading v0.0.5
github.com/aquasecurity/table v1.8.0 github.com/aquasecurity/table v1.8.0
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da github.com/aquasecurity/testdocker v0.0.0-20240419073403-90bd43849334
github.com/aquasecurity/tml v0.6.1 github.com/aquasecurity/tml v0.6.1
github.com/aquasecurity/trivy-aws v0.8.0 github.com/aquasecurity/trivy-aws v0.8.0
github.com/aquasecurity/trivy-checks v0.10.5-0.20240430045208-6cc735de6b9e
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48
github.com/aquasecurity/trivy-kubernetes v0.6.7-0.20240425111126-a549f8de71bb github.com/aquasecurity/trivy-kubernetes v0.6.7-0.20240425111126-a549f8de71bb
github.com/aquasecurity/trivy-policies v0.10.0
github.com/aws/aws-sdk-go-v2 v1.26.1 github.com/aws/aws-sdk-go-v2 v1.26.1
github.com/aws/aws-sdk-go-v2/config v1.27.11 github.com/aws/aws-sdk-go-v2/config v1.27.11
github.com/aws/aws-sdk-go-v2/credentials v1.17.11 github.com/aws/aws-sdk-go-v2/credentials v1.17.11
@@ -42,7 +42,7 @@ require (
github.com/cheggaaa/pb/v3 v3.1.4 github.com/cheggaaa/pb/v3 v3.1.4
github.com/containerd/containerd v1.7.16 github.com/containerd/containerd v1.7.16
github.com/csaf-poc/csaf_distribution/v3 v3.0.0 github.com/csaf-poc/csaf_distribution/v3 v3.0.0
github.com/docker/docker v25.0.5+incompatible github.com/docker/docker v26.0.1+incompatible
github.com/docker/go-connections v0.5.0 github.com/docker/go-connections v0.5.0
github.com/fatih/color v1.16.0 github.com/fatih/color v1.16.0
github.com/go-git/go-git/v5 v5.11.0 github.com/go-git/go-git/v5 v5.11.0
@@ -242,7 +242,7 @@ require (
github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/cyphar/filepath-securejoin v0.2.4 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/distribution/reference v0.5.0 // indirect github.com/distribution/reference v0.6.0 // indirect
github.com/dlclark/regexp2 v1.4.0 // indirect github.com/dlclark/regexp2 v1.4.0 // indirect
github.com/docker/cli v25.0.1+incompatible // indirect github.com/docker/cli v25.0.1+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect
@@ -324,6 +324,7 @@ require (
github.com/mitchellh/go-testing-interface v1.14.1 // indirect github.com/mitchellh/go-testing-interface v1.14.1 // indirect
github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/locker v1.0.1 // indirect github.com/moby/locker v1.0.1 // indirect
github.com/moby/patternmatcher v0.6.0 // indirect github.com/moby/patternmatcher v0.6.0 // indirect
github.com/moby/spdystream v0.2.0 // indirect github.com/moby/spdystream v0.2.0 // indirect
@@ -391,7 +392,6 @@ require (
go.opentelemetry.io/otel/metric v1.24.0 // indirect go.opentelemetry.io/otel/metric v1.24.0 // indirect
go.opentelemetry.io/otel/sdk v1.24.0 // indirect go.opentelemetry.io/otel/sdk v1.24.0 // indirect
go.opentelemetry.io/otel/trace v1.24.0 // indirect go.opentelemetry.io/otel/trace v1.24.0 // indirect
go.opentelemetry.io/proto/otlp v1.1.0 // indirect
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/multierr v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect
golang.org/x/oauth2 v0.18.0 // indirect golang.org/x/oauth2 v0.18.0 // indirect

675
go.sum
View File

File diff suppressed because it is too large Load Diff

4
integration/aws_cloud_test.go
View File

@@ -25,7 +25,7 @@ func TestAwsCommandRun(t *testing.T) {
{ {
name: "fail without region", name: "fail without region",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
}, },
envs: map[string]string{ envs: map[string]string{
"AWS_ACCESS_KEY_ID": "test", "AWS_ACCESS_KEY_ID": "test",
@@ -39,7 +39,7 @@ func TestAwsCommandRun(t *testing.T) {
"AWS_PROFILE": "non-existent-profile", "AWS_PROFILE": "non-existent-profile",
}, },
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
}, },

3
magefiles/magefile.go
View File

@@ -420,16 +420,19 @@ func installed(cmd string) bool {
type Schema mg.Namespace type Schema mg.Namespace
// Generate generates Cloud Schema for misconfiguration scanning
func (Schema) Generate() error { func (Schema) Generate() error {
return sh.RunWith(ENV, "go", "run", "-tags=mage_schema", "./magefiles", "--", "generate") return sh.RunWith(ENV, "go", "run", "-tags=mage_schema", "./magefiles", "--", "generate")
} }
// Verify verifies Cloud Schema for misconfiguration scanning
func (Schema) Verify() error { func (Schema) Verify() error {
return sh.RunWith(ENV, "go", "run", "-tags=mage_schema", "./magefiles", "--", "verify") return sh.RunWith(ENV, "go", "run", "-tags=mage_schema", "./magefiles", "--", "verify")
} }
type CloudActions mg.Namespace type CloudActions mg.Namespace
// Generate generates the list of possible cloud actions with AWS
func (CloudActions) Generate() error { func (CloudActions) Generate() error {
return sh.RunWith(ENV, "go", "run", "-tags=mage_cloudactions", "./magefiles") return sh.RunWith(ENV, "go", "run", "-tags=mage_cloudactions", "./magefiles")
} }

4
mkdocs.yml
View File

@@ -55,8 +55,8 @@ nav:
- Misconfiguration: - Misconfiguration:
- Overview: docs/scanner/misconfiguration/index.md - Overview: docs/scanner/misconfiguration/index.md
- Policy: - Policy:
- Built-in Policies: docs/scanner/misconfiguration/policy/builtin.md - Built-in Checks: docs/scanner/misconfiguration/check/builtin.md
- Exceptions: docs/scanner/misconfiguration/policy/exceptions.md - Exceptions: docs/scanner/misconfiguration/check/exceptions.md
- Custom Policies: - Custom Policies:
- Overview: docs/scanner/misconfiguration/custom/index.md - Overview: docs/scanner/misconfiguration/custom/index.md
- Data: docs/scanner/misconfiguration/custom/data.md - Data: docs/scanner/misconfiguration/custom/data.md

5
pkg/cloud/aws/commands/run.go
View File

@@ -3,6 +3,7 @@ package commands
import ( import (
"context" "context"
"errors" "errors"
"sort"
"strings" "strings"
"github.com/aws/aws-sdk-go-v2/service/sts" "github.com/aws/aws-sdk-go-v2/service/sts"
@@ -161,6 +162,10 @@ func Run(ctx context.Context, opt flag.Options) error {
log.DebugContext(ctx, "Writing report to output...") log.DebugContext(ctx, "Writing report to output...")
sort.Slice(results, func(i, j int) bool {
return results[i].Rule().AVDID < results[j].Rule().AVDID
})
res := results.GetFailed() res := results.GetFailed()
if opt.MisconfOptions.IncludeNonFailures { if opt.MisconfOptions.IncludeNonFailures {
res = results res = results

176
pkg/cloud/aws/commands/run_test.go
View File

@@ -142,30 +142,6 @@ const expectedS3ScanResult = `{
} }
} }
}, },
{
"Type": "AWS",
"ID": "AVD-AWS-0132",
"AVDID": "AVD-AWS-0132",
"Title": "S3 encryption should use Customer Managed Keys",
"Description": "Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.",
"Message": "Bucket does not encrypt data with a customer managed key.",
"Resolution": "Enable encryption using customer managed keys",
"Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0132",
"References": [
"https://avd.aquasec.com/misconfig/avd-aws-0132"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "arn:aws:s3:::examplebucket",
"Provider": "aws",
"Service": "s3",
"Code": {
"Lines": null
}
}
},
{ {
"Type": "AWS", "Type": "AWS",
"ID": "AVD-AWS-0091", "ID": "AVD-AWS-0091",
@@ -260,6 +236,30 @@ const expectedS3ScanResult = `{
"Lines": null "Lines": null
} }
} }
},
{
"Type": "AWS",
"ID": "AVD-AWS-0132",
"AVDID": "AVD-AWS-0132",
"Title": "S3 encryption should use Customer Managed Keys",
"Description": "Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.",
"Message": "Bucket does not encrypt data with a customer managed key.",
"Resolution": "Enable encryption using customer managed keys",
"Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0132",
"References": [
"https://avd.aquasec.com/misconfig/avd-aws-0132"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "arn:aws:s3:::examplebucket",
"Provider": "aws",
"Service": "s3",
"Code": {
"Lines": null
}
}
} }
] ]
} }
@@ -355,7 +355,7 @@ const expectedCustomScanResult = `{
"Type": "AWS", "Type": "AWS",
"Title": "Bad input data", "Title": "Bad input data",
"Description": "Just failing rule with input data", "Description": "Just failing rule with input data",
"Message": "Rego policy resulted in DENY", "Message": "Rego check resulted in DENY",
"Namespace": "user.whatever", "Namespace": "user.whatever",
"Query": "deny", "Query": "deny",
"Severity": "LOW", "Severity": "LOW",
@@ -480,30 +480,6 @@ const expectedCustomScanResult = `{
} }
} }
}, },
{
"Type": "AWS",
"ID": "AVD-AWS-0132",
"AVDID": "AVD-AWS-0132",
"Title": "S3 encryption should use Customer Managed Keys",
"Description": "Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.",
"Message": "Bucket does not encrypt data with a customer managed key.",
"Resolution": "Enable encryption using customer managed keys",
"Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0132",
"References": [
"https://avd.aquasec.com/misconfig/avd-aws-0132"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "arn:aws:s3:::examplebucket",
"Provider": "aws",
"Service": "s3",
"Code": {
"Lines": null
}
}
},
{ {
"Type": "AWS", "Type": "AWS",
"ID": "AVD-AWS-0091", "ID": "AVD-AWS-0091",
@@ -598,6 +574,30 @@ const expectedCustomScanResult = `{
"Lines": null "Lines": null
} }
} }
},
{
"Type": "AWS",
"ID": "AVD-AWS-0132",
"AVDID": "AVD-AWS-0132",
"Title": "S3 encryption should use Customer Managed Keys",
"Description": "Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.",
"Message": "Bucket does not encrypt data with a customer managed key.",
"Resolution": "Enable encryption using customer managed keys",
"Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0132",
"References": [
"https://avd.aquasec.com/misconfig/avd-aws-0132"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "arn:aws:s3:::examplebucket",
"Provider": "aws",
"Service": "s3",
"Code": {
"Lines": null
}
}
} }
] ]
} }
@@ -659,10 +659,10 @@ const expectedS3AndCloudTrailResult = `{
"Type": "AWS", "Type": "AWS",
"ID": "AVD-AWS-0015", "ID": "AVD-AWS-0015",
"AVDID": "AVD-AWS-0015", "AVDID": "AVD-AWS-0015",
"Title": "Cloudtrail should be encrypted at rest to secure access to sensitive trail data", "Title": "CloudTrail should use Customer managed keys to encrypt the logs",
"Description": "Cloudtrail logs should be encrypted at rest to secure the sensitive data. Cloudtrail logs record all activity that occurs in the the account through API calls and would be one of the first places to look when reacting to a breach.", "Description": "Using Customer managed keys provides comprehensive control over cryptographic keys, enabling management of policies, permissions, and rotation, thus enhancing security and compliance measures for sensitive data and systems.",
"Message": "Trail is not encrypted.", "Message": "CloudTrail does not use a customer managed key to encrypt the logs.",
"Resolution": "Enable encryption at rest", "Resolution": "Use Customer managed key",
"Severity": "HIGH", "Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0015", "PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0015",
"References": [ "References": [
@@ -835,30 +835,6 @@ const expectedS3AndCloudTrailResult = `{
} }
} }
}, },
{
"Type": "AWS",
"ID": "AVD-AWS-0132",
"AVDID": "AVD-AWS-0132",
"Title": "S3 encryption should use Customer Managed Keys",
"Description": "Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.",
"Message": "Bucket does not encrypt data with a customer managed key.",
"Resolution": "Enable encryption using customer managed keys",
"Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0132",
"References": [
"https://avd.aquasec.com/misconfig/avd-aws-0132"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "arn:aws:s3:::examplebucket",
"Provider": "aws",
"Service": "s3",
"Code": {
"Lines": null
}
}
},
{ {
"Type": "AWS", "Type": "AWS",
"ID": "AVD-AWS-0091", "ID": "AVD-AWS-0091",
@@ -953,6 +929,30 @@ const expectedS3AndCloudTrailResult = `{
"Lines": null "Lines": null
} }
} }
},
{
"Type": "AWS",
"ID": "AVD-AWS-0132",
"AVDID": "AVD-AWS-0132",
"Title": "S3 encryption should use Customer Managed Keys",
"Description": "Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.",
"Message": "Bucket does not encrypt data with a customer managed key.",
"Resolution": "Enable encryption using customer managed keys",
"Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/avd-aws-0132",
"References": [
"https://avd.aquasec.com/misconfig/avd-aws-0132"
],
"Status": "FAIL",
"Layer": {},
"CauseMetadata": {
"Resource": "arn:aws:s3:::examplebucket",
"Provider": "aws",
"Service": "s3",
"Code": {
"Lines": null
}
}
} }
] ]
} }
@@ -977,7 +977,7 @@ func Test_Run(t *testing.T) {
{ {
name: "succeed with cached infra", name: "succeed with cached infra",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
Services: []string{"s3"}, Services: []string{"s3"},
@@ -1005,16 +1005,16 @@ func Test_Run(t *testing.T) {
}, },
RegoOptions: flag.RegoOptions{ RegoOptions: flag.RegoOptions{
Trace: true, Trace: true,
PolicyPaths: []string{ CheckPaths: []string{
filepath.Join(regoDir, "policies"), filepath.Join(regoDir, "policies"),
}, },
PolicyNamespaces: []string{ CheckNamespaces: []string{
"user", "user",
}, },
DataPaths: []string{ DataPaths: []string{
filepath.Join(regoDir, "data"), filepath.Join(regoDir, "data"),
}, },
SkipPolicyUpdate: true, SkipCheckUpdate: true,
}, },
MisconfOptions: flag.MisconfOptions{IncludeNonFailures: true}, MisconfOptions: flag.MisconfOptions{IncludeNonFailures: true},
}, },
@@ -1082,7 +1082,7 @@ deny {
Format: "table", Format: "table",
ReportFormat: "summary", ReportFormat: "summary",
}, },
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
}, },
cacheContent: "testdata/s3onlycache.json", cacheContent: "testdata/s3onlycache.json",
allServices: []string{"s3"}, allServices: []string{"s3"},
@@ -1098,7 +1098,7 @@ Summary Report for compliance: my-custom-spec
{ {
name: "scan an unsupported service", name: "scan an unsupported service",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
Account: "123456789", Account: "123456789",
@@ -1115,7 +1115,7 @@ Summary Report for compliance: my-custom-spec
{ {
name: "scan every service", name: "scan every service",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
Account: "123456789", Account: "123456789",
@@ -1135,7 +1135,7 @@ Summary Report for compliance: my-custom-spec
{ {
name: "skip certain services and include specific services", name: "skip certain services and include specific services",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
Services: []string{"s3"}, Services: []string{"s3"},
@@ -1158,7 +1158,7 @@ Summary Report for compliance: my-custom-spec
{ {
name: "only skip certain services but scan the rest", name: "only skip certain services but scan the rest",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
SkipServices: []string{ SkipServices: []string{
@@ -1183,7 +1183,7 @@ Summary Report for compliance: my-custom-spec
{ {
name: "fail - service specified to both include and exclude", name: "fail - service specified to both include and exclude",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
Services: []string{"s3"}, Services: []string{"s3"},
@@ -1201,7 +1201,7 @@ Summary Report for compliance: my-custom-spec
{ {
name: "ignore findings with .trivyignore", name: "ignore findings with .trivyignore",
options: flag.Options{ options: flag.Options{
RegoOptions: flag.RegoOptions{SkipPolicyUpdate: true}, RegoOptions: flag.RegoOptions{SkipCheckUpdate: true},
AWSOptions: flag.AWSOptions{ AWSOptions: flag.AWSOptions{
Region: "us-east-1", Region: "us-east-1",
Services: []string{"s3"}, Services: []string{"s3"},

13
pkg/cloud/aws/scanner/scanner.go
View File

@@ -72,13 +72,14 @@ func (s *AWSScanner) Scan(ctx context.Context, option flag.Options) (scan.Result
var policyPaths []string var policyPaths []string
var downloadedPolicyPaths []string var downloadedPolicyPaths []string
var err error var err error
downloadedPolicyPaths, err = operation.InitBuiltinPolicies(context.Background(), option.CacheDir, option.Quiet, option.SkipPolicyUpdate, option.MisconfOptions.PolicyBundleRepository, option.RegistryOpts())
downloadedPolicyPaths, err = operation.InitBuiltinPolicies(context.Background(), option.CacheDir, option.Quiet, option.SkipCheckUpdate, option.MisconfOptions.ChecksBundleRepository, option.RegistryOpts())
if err != nil { if err != nil {
if !option.SkipPolicyUpdate { if !option.SkipCheckUpdate {
s.logger.Error("Falling back to embedded policies", log.Err(err)) s.logger.Error("Falling back to embedded checks", log.Err(err))
} }
} else { } else {
s.logger.Debug("Policies successfully loaded from disk") s.logger.Debug("Checks successfully loaded from disk")
policyPaths = append(policyPaths, downloadedPolicyPaths...) policyPaths = append(policyPaths, downloadedPolicyPaths...)
scannerOpts = append(scannerOpts, scannerOpts = append(scannerOpts,
options.ScannerWithEmbeddedPolicies(false), options.ScannerWithEmbeddedPolicies(false),
@@ -86,7 +87,7 @@ func (s *AWSScanner) Scan(ctx context.Context, option flag.Options) (scan.Result
} }
var policyFS fs.FS var policyFS fs.FS
policyFS, policyPaths, err = misconf.CreatePolicyFS(append(policyPaths, option.RegoOptions.PolicyPaths...)) policyFS, policyPaths, err = misconf.CreatePolicyFS(append(policyPaths, option.RegoOptions.CheckPaths...))
if err != nil { if err != nil {
return nil, false, xerrors.Errorf("unable to create policyfs: %w", err) return nil, false, xerrors.Errorf("unable to create policyfs: %w", err)
} }
@@ -105,7 +106,7 @@ func (s *AWSScanner) Scan(ctx context.Context, option flag.Options) (scan.Result
options.ScannerWithDataFilesystem(dataFS), options.ScannerWithDataFilesystem(dataFS),
) )
scannerOpts = addPolicyNamespaces(option.RegoOptions.PolicyNamespaces, scannerOpts) scannerOpts = addPolicyNamespaces(option.RegoOptions.CheckNamespaces, scannerOpts)
if option.Compliance.Spec.ID != "" { if option.Compliance.Spec.ID != "" {
scannerOpts = append(scannerOpts, options.ScannerWithSpec(option.Compliance.Spec.ID)) scannerOpts = append(scannerOpts, options.ScannerWithSpec(option.Compliance.Spec.ID))

4
pkg/commands/app.go
View File

@@ -1230,10 +1230,10 @@ func showVersion(cacheDir, outputFormat string, w io.Writer) error {
} }
func validateArgs(cmd *cobra.Command, args []string) error { func validateArgs(cmd *cobra.Command, args []string) error {
// '--clear-cache', '--download-db-only', '--download-java-db-only', '--reset' and '--generate-default-config' don't conduct the subsequent scanning // '--clear-cache', '--download-db-only', '--download-java-db-only', '--reset', '--reset-checks-bundle' and '--generate-default-config' don't conduct the subsequent scanning
if viper.GetBool(flag.ClearCacheFlag.ConfigName) || viper.GetBool(flag.DownloadDBOnlyFlag.ConfigName) || if viper.GetBool(flag.ClearCacheFlag.ConfigName) || viper.GetBool(flag.DownloadDBOnlyFlag.ConfigName) ||
viper.GetBool(flag.ResetFlag.ConfigName) || viper.GetBool(flag.GenerateDefaultConfigFlag.ConfigName) || viper.GetBool(flag.ResetFlag.ConfigName) || viper.GetBool(flag.GenerateDefaultConfigFlag.ConfigName) ||
viper.GetBool(flag.DownloadJavaDBOnlyFlag.ConfigName) || viper.GetBool(flag.ResetPolicyBundleFlag.ConfigName) { viper.GetBool(flag.DownloadJavaDBOnlyFlag.ConfigName) || viper.GetBool(flag.ResetChecksBundleFlag.ConfigName) {
return nil return nil
} }

6
pkg/commands/app_test.go
View File

@@ -43,7 +43,7 @@ Java DB:
UpdatedAt: 2023-03-14 00:47:02.774253754 +0000 UTC UpdatedAt: 2023-03-14 00:47:02.774253754 +0000 UTC
NextUpdate: 2023-03-17 00:47:02.774253254 +0000 UTC NextUpdate: 2023-03-17 00:47:02.774253254 +0000 UTC
DownloadedAt: 2023-03-14 03:04:55.058541039 +0000 UTC DownloadedAt: 2023-03-14 03:04:55.058541039 +0000 UTC
Policy Bundle: Check Bundle:
Digest: sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd Digest: sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd
DownloadedAt: 2023-03-02 01:06:08.191725 +0000 UTC DownloadedAt: 2023-03-02 01:06:08.191725 +0000 UTC
`, `,
@@ -81,11 +81,11 @@ Java DB:
UpdatedAt: 2023-03-14 00:47:02.774253754 +0000 UTC UpdatedAt: 2023-03-14 00:47:02.774253754 +0000 UTC
NextUpdate: 2023-03-17 00:47:02.774253254 +0000 UTC NextUpdate: 2023-03-17 00:47:02.774253254 +0000 UTC
DownloadedAt: 2023-03-14 03:04:55.058541039 +0000 UTC DownloadedAt: 2023-03-14 03:04:55.058541039 +0000 UTC
Policy Bundle: Check Bundle:
Digest: sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd Digest: sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd
DownloadedAt: 2023-03-02 01:06:08.191725 +0000 UTC DownloadedAt: 2023-03-02 01:06:08.191725 +0000 UTC
` `
jsonOutput := `{"Version":"dev","VulnerabilityDB":{"Version":2,"NextUpdate":"2022-03-02T12:07:07.99504023Z","UpdatedAt":"2022-03-02T06:07:07.99504083Z","DownloadedAt":"2022-03-02T10:03:38.383312Z"},"JavaDB":{"Version":1,"NextUpdate":"2023-03-17T00:47:02.774253254Z","UpdatedAt":"2023-03-14T00:47:02.774253754Z","DownloadedAt":"2023-03-14T03:04:55.058541039Z"},"PolicyBundle":{"Digest":"sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd","DownloadedAt":"2023-03-02T01:06:08.191725Z"}} jsonOutput := `{"Version":"dev","VulnerabilityDB":{"Version":2,"NextUpdate":"2022-03-02T12:07:07.99504023Z","UpdatedAt":"2022-03-02T06:07:07.99504083Z","DownloadedAt":"2022-03-02T10:03:38.383312Z"},"JavaDB":{"Version":1,"NextUpdate":"2023-03-17T00:47:02.774253254Z","UpdatedAt":"2023-03-14T00:47:02.774253754Z","DownloadedAt":"2023-03-14T03:04:55.058541039Z"},"CheckBundle":{"Digest":"sha256:19a017cdc798631ad42f6f4dce823d77b2989128f0e1a7f9bc83ae3c59024edd","DownloadedAt":"2023-03-02T01:06:08.191725Z"}}
` `
tests := []struct { tests := []struct {
name string name string

17
pkg/commands/artifact/run.go
View File

@@ -367,10 +367,10 @@ func (r *runner) initCache(opts flag.Options) error {
return SkipScan return SkipScan
} }
if opts.ResetPolicyBundle { if opts.ResetChecksBundle {
c, err := policy.NewClient(fsutils.CacheDir(), true, opts.MisconfOptions.PolicyBundleRepository) c, err := policy.NewClient(fsutils.CacheDir(), true, opts.MisconfOptions.ChecksBundleRepository)
if err != nil { if err != nil {
return xerrors.Errorf("failed to instantiate policy client: %w", err) return xerrors.Errorf("failed to instantiate check client: %w", err)
} }
if err := c.Clear(); err != nil { if err := c.Clear(); err != nil {
return xerrors.Errorf("failed to remove the cache: %w", err) return xerrors.Errorf("failed to remove the cache: %w", err)
@@ -579,10 +579,11 @@ func initScannerConfig(opts flag.Options, cacheClient cache.Cache) (ScannerConfi
var downloadedPolicyPaths []string var downloadedPolicyPaths []string
var disableEmbedded bool var disableEmbedded bool
downloadedPolicyPaths, err := operation.InitBuiltinPolicies(context.Background(), opts.CacheDir, opts.Quiet, opts.SkipPolicyUpdate, opts.MisconfOptions.PolicyBundleRepository, opts.RegistryOpts())
downloadedPolicyPaths, err := operation.InitBuiltinPolicies(context.Background(), opts.CacheDir, opts.Quiet, opts.SkipCheckUpdate, opts.MisconfOptions.ChecksBundleRepository, opts.RegistryOpts())
if err != nil { if err != nil {
if !opts.SkipPolicyUpdate { if !opts.SkipCheckUpdate {
log.Error("Falling back to embedded policies", log.Err(err)) log.Error("Falling back to embedded checks", log.Err(err))
} }
} else { } else {
log.Debug("Policies successfully loaded from disk") log.Debug("Policies successfully loaded from disk")
@@ -591,8 +592,8 @@ func initScannerConfig(opts flag.Options, cacheClient cache.Cache) (ScannerConfi
configScannerOptions = misconf.ScannerOption{ configScannerOptions = misconf.ScannerOption{
Debug: opts.Debug, Debug: opts.Debug,
Trace: opts.Trace, Trace: opts.Trace,
Namespaces: append(opts.PolicyNamespaces, rego.BuiltinNamespaces()...), Namespaces: append(opts.CheckNamespaces, rego.BuiltinNamespaces()...),
PolicyPaths: append(opts.PolicyPaths, downloadedPolicyPaths...), PolicyPaths: append(opts.CheckPaths, downloadedPolicyPaths...),
DataPaths: opts.DataPaths, DataPaths: opts.DataPaths,
HelmValues: opts.HelmValues, HelmValues: opts.HelmValues,
HelmValueFiles: opts.HelmValueFiles, HelmValueFiles: opts.HelmValueFiles,

10
pkg/commands/operation/operation.go
View File

@@ -149,13 +149,13 @@ func showDBInfo(cacheDir string) error {
} }
// InitBuiltinPolicies downloads the built-in policies and loads them // InitBuiltinPolicies downloads the built-in policies and loads them
func InitBuiltinPolicies(ctx context.Context, cacheDir string, quiet, skipUpdate bool, policyBundleRepository string, registryOpts ftypes.RegistryOptions) ([]string, error) { func InitBuiltinPolicies(ctx context.Context, cacheDir string, quiet, skipUpdate bool, checkBundleRepository string, registryOpts ftypes.RegistryOptions) ([]string, error) {
mu.Lock() mu.Lock()
defer mu.Unlock() defer mu.Unlock()
client, err := policy.NewClient(cacheDir, quiet, policyBundleRepository) client, err := policy.NewClient(cacheDir, quiet, checkBundleRepository)
if err != nil { if err != nil {
return nil, xerrors.Errorf("policy client error: %w", err) return nil, xerrors.Errorf("check client error: %w", err)
} }
needsUpdate := false needsUpdate := false
@@ -177,11 +177,11 @@ func InitBuiltinPolicies(ctx context.Context, cacheDir string, quiet, skipUpdate
policyPaths, err := client.LoadBuiltinPolicies() policyPaths, err := client.LoadBuiltinPolicies()
if err != nil { if err != nil {
if skipUpdate { if skipUpdate {
msg := "No downloadable policies were loaded as --skip-policy-update is enabled" msg := "No downloadable policies were loaded as --skip-check-update is enabled"
log.Info(msg) log.Info(msg)
return nil, xerrors.Errorf(msg) return nil, xerrors.Errorf(msg)
} }
return nil, xerrors.Errorf("policy load error: %w", err) return nil, xerrors.Errorf("check load error: %w", err)
} }
return policyPaths, nil return policyPaths, nil
} }

2
pkg/compliance/spec/compliance.go
View File

@@ -9,7 +9,7 @@ import (
"golang.org/x/xerrors" "golang.org/x/xerrors"
"gopkg.in/yaml.v3" "gopkg.in/yaml.v3"
sp "github.com/aquasecurity/trivy-policies/pkg/spec" sp "github.com/aquasecurity/trivy-checks/pkg/spec"
iacTypes "github.com/aquasecurity/trivy/pkg/iac/types" iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
"github.com/aquasecurity/trivy/pkg/types" "github.com/aquasecurity/trivy/pkg/types"
) )

2
pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go
View File

@@ -33,7 +33,7 @@ func Test_historyAnalyzer_Analyze(t *testing.T) {
}, },
History: []v1.History{ History: []v1.History{
{ {
// this is fine, see https://github.com/aquasecurity/trivy-policies/pull/60 for details // this is fine, see https://github.com/aquasecurity/trivy-checks/pull/60 for details
CreatedBy: "/bin/sh -c #(nop) ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /", CreatedBy: "/bin/sh -c #(nop) ADD file:e4d600fc4c9c293efe360be7b30ee96579925d1b4634c94332e2ec73f7d8eca1 in /",
EmptyLayer: false, EmptyLayer: false,
}, },

2
pkg/fanal/cache/key.go vendored
View File

@@ -36,7 +36,7 @@ func CalcKey(id string, analyzerVersions analyzer.Versions, hookVersions map[str
return "", xerrors.Errorf("json encode error: %w", err) return "", xerrors.Errorf("json encode error: %w", err)
} }
// Write policy, data contents and secret config file // Write check, data contents and secret config file
paths := append(artifactOpt.MisconfScannerOption.PolicyPaths, artifactOpt.MisconfScannerOption.DataPaths...) paths := append(artifactOpt.MisconfScannerOption.PolicyPaths, artifactOpt.MisconfScannerOption.DataPaths...)
// Check if the secret config exists. // Check if the secret config exists.

44
pkg/flag/misconf_flags.go
View File

@@ -15,10 +15,17 @@ import (
// config-policy: "custom-policy/policy" // config-policy: "custom-policy/policy"
// policy-namespaces: "user" // policy-namespaces: "user"
var ( var (
ResetPolicyBundleFlag = Flag[bool]{ ResetChecksBundleFlag = Flag[bool]{
Name: "reset-checks-bundle",
ConfigName: "misconfiguration.reset-checks-bundle",
Usage: "remove checks bundle",
Aliases: []Alias{
{
Name: "reset-policy-bundle", Name: "reset-policy-bundle",
ConfigName: "misconfiguration.reset-policy-bundle", ConfigName: "misconfiguration.reset-policy-bundle",
Usage: "remove policy bundle", Deprecated: true,
},
},
} }
IncludeNonFailuresFlag = Flag[bool]{ IncludeNonFailuresFlag = Flag[bool]{
Name: "include-non-failures", Name: "include-non-failures",
@@ -71,11 +78,18 @@ var (
ConfigName: "misconfiguration.terraform.exclude-downloaded-modules", ConfigName: "misconfiguration.terraform.exclude-downloaded-modules",
Usage: "exclude misconfigurations for downloaded terraform modules", Usage: "exclude misconfigurations for downloaded terraform modules",
} }
PolicyBundleRepositoryFlag = Flag[string]{ ChecksBundleRepositoryFlag = Flag[string]{
Name: "checks-bundle-repository",
ConfigName: "misconfiguration.checks-bundle-repository",
Default: fmt.Sprintf("%s:%d", policy.BundleRepository, policy.BundleVersion),
Usage: "OCI registry URL to retrieve checks bundle from",
Aliases: []Alias{
{
Name: "policy-bundle-repository", Name: "policy-bundle-repository",
ConfigName: "misconfiguration.policy-bundle-repository", ConfigName: "misconfiguration.policy-bundle-repository",
Default: fmt.Sprintf("%s:%d", policy.BundleRepository, policy.BundleVersion), Deprecated: true,
Usage: "OCI registry URL to retrieve policy bundle from", },
},
} }
MisconfigScannersFlag = Flag[[]string]{ MisconfigScannersFlag = Flag[[]string]{
Name: "misconfig-scanners", Name: "misconfig-scanners",
@@ -88,8 +102,8 @@ var (
// MisconfFlagGroup composes common printer flag structs used for commands providing misconfiguration scanning. // MisconfFlagGroup composes common printer flag structs used for commands providing misconfiguration scanning.
type MisconfFlagGroup struct { type MisconfFlagGroup struct {
IncludeNonFailures *Flag[bool] IncludeNonFailures *Flag[bool]
ResetPolicyBundle *Flag[bool] ResetChecksBundle *Flag[bool]
PolicyBundleRepository *Flag[string] ChecksBundleRepository *Flag[string]
// Values Files // Values Files
HelmValues *Flag[[]string] HelmValues *Flag[[]string]
@@ -106,8 +120,8 @@ type MisconfFlagGroup struct {
type MisconfOptions struct { type MisconfOptions struct {
IncludeNonFailures bool IncludeNonFailures bool
ResetPolicyBundle bool ResetChecksBundle bool
PolicyBundleRepository string ChecksBundleRepository string
// Values Files // Values Files
HelmValues []string HelmValues []string
@@ -125,8 +139,8 @@ type MisconfOptions struct {
func NewMisconfFlagGroup() *MisconfFlagGroup { func NewMisconfFlagGroup() *MisconfFlagGroup {
return &MisconfFlagGroup{ return &MisconfFlagGroup{
IncludeNonFailures: IncludeNonFailuresFlag.Clone(), IncludeNonFailures: IncludeNonFailuresFlag.Clone(),
ResetPolicyBundle: ResetPolicyBundleFlag.Clone(), ResetChecksBundle: ResetChecksBundleFlag.Clone(),
PolicyBundleRepository: PolicyBundleRepositoryFlag.Clone(), ChecksBundleRepository: ChecksBundleRepositoryFlag.Clone(),
HelmValues: HelmSetFlag.Clone(), HelmValues: HelmSetFlag.Clone(),
HelmFileValues: HelmSetFileFlag.Clone(), HelmFileValues: HelmSetFileFlag.Clone(),
@@ -148,8 +162,8 @@ func (f *MisconfFlagGroup) Name() string {
func (f *MisconfFlagGroup) Flags() []Flagger { func (f *MisconfFlagGroup) Flags() []Flagger {
return []Flagger{ return []Flagger{
f.IncludeNonFailures, f.IncludeNonFailures,
f.ResetPolicyBundle, f.ResetChecksBundle,
f.PolicyBundleRepository, f.ChecksBundleRepository,
f.HelmValues, f.HelmValues,
f.HelmValueFiles, f.HelmValueFiles,
f.HelmFileValues, f.HelmFileValues,
@@ -170,8 +184,8 @@ func (f *MisconfFlagGroup) ToOptions() (MisconfOptions, error) {
return MisconfOptions{ return MisconfOptions{
IncludeNonFailures: f.IncludeNonFailures.Value(), IncludeNonFailures: f.IncludeNonFailures.Value(),
ResetPolicyBundle: f.ResetPolicyBundle.Value(), ResetChecksBundle: f.ResetChecksBundle.Value(),
PolicyBundleRepository: f.PolicyBundleRepository.Value(), ChecksBundleRepository: f.ChecksBundleRepository.Value(),
HelmValues: f.HelmValues.Value(), HelmValues: f.HelmValues.Value(),
HelmValueFiles: f.HelmValueFiles.Value(), HelmValueFiles: f.HelmValueFiles.Value(),
HelmFileValues: f.HelmFileValues.Value(), HelmFileValues: f.HelmFileValues.Value(),

60
pkg/flag/rego_flags.go
View File

@@ -7,66 +7,74 @@ package flag
// config-policy: "custom-policy/policy" // config-policy: "custom-policy/policy"
// policy-namespaces: "user" // policy-namespaces: "user"
var ( var (
SkipPolicyUpdateFlag = Flag[bool]{ SkipCheckUpdateFlag = Flag[bool]{
Name: "skip-check-update",
ConfigName: "rego.skip-check-update",
Usage: "skip fetching rego check updates",
Aliases: []Alias{
{
Name: "skip-policy-update", Name: "skip-policy-update",
ConfigName: "rego.skip-policy-update", Deprecated: true,
Usage: "skip fetching rego policy updates", },
},
} }
TraceFlag = Flag[bool]{ TraceFlag = Flag[bool]{
Name: "trace", Name: "trace",
ConfigName: "rego.trace", ConfigName: "rego.trace",
Usage: "enable more verbose trace output for custom queries", Usage: "enable more verbose trace output for custom queries",
} }
ConfigPolicyFlag = Flag[[]string]{ ConfigCheckFlag = Flag[[]string]{
Name: "config-policy", Name: "config-check",
ConfigName: "rego.policy", ConfigName: "rego.check",
Usage: "specify the paths to the Rego policy files or to the directories containing them, applying config files", Usage: "specify the paths to the Rego check files or to the directories containing them, applying config files",
Aliases: []Alias{ Aliases: []Alias{
{Name: "policy"}, {Name: "policy", Deprecated: true},
{Name: "config-policy", Deprecated: true},
}, },
} }
ConfigDataFlag = Flag[[]string]{ ConfigDataFlag = Flag[[]string]{
Name: "config-data", Name: "config-data",
ConfigName: "rego.data", ConfigName: "rego.data",
Usage: "specify paths from which data for the Rego policies will be recursively loaded", Usage: "specify paths from which data for the Rego checks will be recursively loaded",
Aliases: []Alias{ Aliases: []Alias{
{Name: "data"}, {Name: "data"},
}, },
} }
PolicyNamespaceFlag = Flag[[]string]{ CheckNamespaceFlag = Flag[[]string]{
Name: "policy-namespaces", Name: "check-namespaces",
ConfigName: "rego.namespaces", ConfigName: "rego.namespaces",
Usage: "Rego namespaces", Usage: "Rego namespaces",
Aliases: []Alias{ Aliases: []Alias{
{Name: "namespaces"}, {Name: "namespaces"},
{Name: "policy-namespaces", Deprecated: true},
}, },
} }
) )
// RegoFlagGroup composes common printer flag structs used for commands providing misconfinguration scanning. // RegoFlagGroup composes common printer flag structs used for commands providing misconfinguration scanning.
type RegoFlagGroup struct { type RegoFlagGroup struct {
SkipPolicyUpdate *Flag[bool] SkipCheckUpdate *Flag[bool]
Trace *Flag[bool] Trace *Flag[bool]
PolicyPaths *Flag[[]string] CheckPaths *Flag[[]string]
DataPaths *Flag[[]string] DataPaths *Flag[[]string]
PolicyNamespaces *Flag[[]string] CheckNamespaces *Flag[[]string]
} }
type RegoOptions struct { type RegoOptions struct {
SkipPolicyUpdate bool SkipCheckUpdate bool
Trace bool Trace bool
PolicyPaths []string CheckPaths []string
DataPaths []string DataPaths []string
PolicyNamespaces []string CheckNamespaces []string
} }
func NewRegoFlagGroup() *RegoFlagGroup { func NewRegoFlagGroup() *RegoFlagGroup {
return &RegoFlagGroup{ return &RegoFlagGroup{
SkipPolicyUpdate: SkipPolicyUpdateFlag.Clone(), SkipCheckUpdate: SkipCheckUpdateFlag.Clone(),
Trace: TraceFlag.Clone(), Trace: TraceFlag.Clone(),
PolicyPaths: ConfigPolicyFlag.Clone(), CheckPaths: ConfigCheckFlag.Clone(),
DataPaths: ConfigDataFlag.Clone(), DataPaths: ConfigDataFlag.Clone(),
PolicyNamespaces: PolicyNamespaceFlag.Clone(), CheckNamespaces: CheckNamespaceFlag.Clone(),
} }
} }
@@ -76,11 +84,11 @@ func (f *RegoFlagGroup) Name() string {
func (f *RegoFlagGroup) Flags() []Flagger { func (f *RegoFlagGroup) Flags() []Flagger {
return []Flagger{ return []Flagger{
f.SkipPolicyUpdate, f.SkipCheckUpdate,
f.Trace, f.Trace,
f.PolicyPaths, f.CheckPaths,
f.DataPaths, f.DataPaths,
f.PolicyNamespaces, f.CheckNamespaces,
} }
} }
@@ -90,10 +98,10 @@ func (f *RegoFlagGroup) ToOptions() (RegoOptions, error) {
} }
return RegoOptions{ return RegoOptions{
SkipPolicyUpdate: f.SkipPolicyUpdate.Value(), SkipCheckUpdate: f.SkipCheckUpdate.Value(),
Trace: f.Trace.Value(), Trace: f.Trace.Value(),
PolicyPaths: f.PolicyPaths.Value(), CheckPaths: f.CheckPaths.Value(),
DataPaths: f.DataPaths.Value(), DataPaths: f.DataPaths.Value(),
PolicyNamespaces: f.PolicyNamespaces.Value(), CheckNamespaces: f.CheckNamespaces.Value(),
}, nil }, nil
} }

2
pkg/iac/rego/embed.go
View File

@@ -8,7 +8,7 @@ import (
"github.com/open-policy-agent/opa/ast" "github.com/open-policy-agent/opa/ast"
checks "github.com/aquasecurity/trivy-policies" checks "github.com/aquasecurity/trivy-checks"
"github.com/aquasecurity/trivy/pkg/iac/rules" "github.com/aquasecurity/trivy/pkg/iac/rules"
) )

4
pkg/iac/rego/embed_test.go
View File

@@ -3,7 +3,7 @@ package rego
import ( import (
"testing" "testing"
rules2 "github.com/aquasecurity/trivy-policies" checks "github.com/aquasecurity/trivy-checks"
"github.com/aquasecurity/trivy/pkg/iac/rules" "github.com/aquasecurity/trivy/pkg/iac/rules"
"github.com/open-policy-agent/opa/ast" "github.com/open-policy-agent/opa/ast"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
@@ -84,7 +84,7 @@ deny[res]{
for _, tc := range testCases { for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) { t.Run(tc.name, func(t *testing.T) {
policies, err := LoadPoliciesFromDirs(rules2.EmbeddedLibraryFileSystem, ".") policies, err := LoadPoliciesFromDirs(checks.EmbeddedLibraryFileSystem, ".")
require.NoError(t, err) require.NoError(t, err)
newRule, err := ast.ParseModuleWithOpts("/rules/newrule.rego", tc.inputPolicy, ast.ParserOptions{ newRule, err := ast.ParseModuleWithOpts("/rules/newrule.rego", tc.inputPolicy, ast.ParserOptions{
ProcessAnnotation: true, ProcessAnnotation: true,

4
pkg/iac/rego/load.go
View File

@@ -173,7 +173,7 @@ func (s *Scanner) fallbackChecks(compiler *ast.Compiler) {
} }
s.debug.Log("Found embedded check: %s", embedded.Package.Location.File) s.debug.Log("Found embedded check: %s", embedded.Package.Location.File)
delete(s.policies, loc) // remove bad policy delete(s.policies, loc) // remove bad check
s.policies[embedded.Package.Location.File] = embedded s.policies[embedded.Package.Location.File] = embedded
delete(s.embeddedChecks, embedded.Package.Location.File) // avoid infinite loop if embedded check contains ref error delete(s.embeddedChecks, embedded.Package.Location.File) // avoid infinite loop if embedded check contains ref error
excludedFiles = append(excludedFiles, e.Location.File) excludedFiles = append(excludedFiles, e.Location.File)
@@ -228,7 +228,7 @@ func (s *Scanner) compilePolicies(srcFS fs.FS, paths []string) error {
return err return err
} }
if custom { if custom {
s.inputSchema = nil // discard auto detected input schema in favor of policy defined schema s.inputSchema = nil // discard auto detected input schema in favor of check defined schema
} }
compiler := ast.NewCompiler(). compiler := ast.NewCompiler().

4
pkg/iac/rego/load_test.go
View File

@@ -8,7 +8,7 @@ import (
"testing" "testing"
"testing/fstest" "testing/fstest"
trivy_policies "github.com/aquasecurity/trivy-policies" checks "github.com/aquasecurity/trivy-checks"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
@@ -197,7 +197,7 @@ deny {
} }
fsys := fstest.MapFS(tt.files) fsys := fstest.MapFS(tt.files)
trivy_policies.EmbeddedPolicyFileSystem = embeddedChecksFS checks.EmbeddedPolicyFileSystem = embeddedChecksFS
err := scanner.LoadPolicies(false, false, fsys, []string{"."}, nil) err := scanner.LoadPolicies(false, false, fsys, []string{"."}, nil)
if tt.expectedErr != "" { if tt.expectedErr != "" {

4
pkg/iac/rego/result.go
View File

@@ -67,7 +67,7 @@ func parseResult(raw interface{}) *regoResult {
case map[string]interface{}: case map[string]interface{}:
result = parseCause(val) result = parseCause(val)
default: default:
result.Message = "Rego policy resulted in DENY" result.Message = "Rego check resulted in DENY"
} }
return &result return &result
} }
@@ -150,7 +150,7 @@ func (s *Scanner) convertResults(set rego.ResultSet, input Input, namespace, rul
regoResult.Filepath = input.Path regoResult.Filepath = input.Path
} }
if regoResult.Message == "" { if regoResult.Message == "" {
regoResult.Message = fmt.Sprintf("Rego policy rule: %s.%s", namespace, rule) regoResult.Message = fmt.Sprintf("Rego check rule: %s.%s", namespace, rule)
} }
regoResult.StartLine += offset regoResult.StartLine += offset
regoResult.EndLine += offset regoResult.EndLine += offset

2
pkg/iac/rego/result_test.go
View File

@@ -17,7 +17,7 @@ func Test_parseResult(t *testing.T) {
input: nil, input: nil,
want: regoResult{ want: regoResult{
Managed: true, Managed: true,
Message: "Rego policy resulted in DENY", Message: "Rego check resulted in DENY",
}, },
}, },
{ {

4
pkg/iac/rego/scanner.go
View File

@@ -248,7 +248,7 @@ func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results,
} }
if isPolicyWithSubtype(s.sourceType) { if isPolicyWithSubtype(s.sourceType) {
// skip if policy isn't relevant to what is being scanned // skip if check isn't relevant to what is being scanned
if !isPolicyApplicable(staticMeta, inputs...) { if !isPolicyApplicable(staticMeta, inputs...) {
continue continue
} }
@@ -326,7 +326,7 @@ func isPolicyApplicable(staticMetadata *StaticMetadata, inputs ...Input) bool {
continue continue
} }
if len(staticMetadata.InputOptions.Selectors) == 0 { // policy always applies if no selectors if len(staticMetadata.InputOptions.Selectors) == 0 { // check always applies if no selectors
return true return true
} }

2
pkg/iac/rego/schemas/dockerfile.json
View File

@@ -1,6 +1,6 @@
{ {
"$schema": "https://json-schema.org/draft/2020-12/schema", "$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://github.com/aquasecurity/trivy-policies/blob/main/pkg/rego/schemas/dockerfile.json", "$id": "https://github.com/aquasecurity/trivy/blob/main/pkg/iac/rego/schemas/dockerfile.json",
"type": "object", "type": "object",
"properties": { "properties": {
"Stages": { "Stages": {

2
pkg/iac/rego/schemas/kubernetes.json
View File

@@ -1,6 +1,6 @@
{ {
"$schema": "https://json-schema.org/draft/2020-12/schema", "$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://github.com/aquasecurity/trivy-policies/blob/main/pkg/rego/schemas/kubernetes.json", "$id": "https://github.com/aquasecurity/trivy/blob/main/pkg/iac/rego/schemas/kubernetes.json",
"type": "object", "type": "object",
"properties": { "properties": {
"apiVersion": { "apiVersion": {

2
pkg/iac/rego/schemas/rbac.json
View File

@@ -1,6 +1,6 @@
{ {
"$schema": "https://json-schema.org/draft/2020-12/schema", "$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://github.com/aquasecurity/trivy-policies/blob/main/pkg/rego/schemas/rbac.json", "$id": "https://github.com/aquasecurity/trivy/blob/main/pkg/iac/rego/schemas/rbac.json",
"type": "object", "type": "object",
"properties": { "properties": {
"apiVersion": { "apiVersion": {

2
pkg/iac/rules/register.go
View File

@@ -5,7 +5,7 @@ import (
"gopkg.in/yaml.v3" "gopkg.in/yaml.v3"
"github.com/aquasecurity/trivy-policies/specs" "github.com/aquasecurity/trivy-checks/specs"
"github.com/aquasecurity/trivy/pkg/iac/framework" "github.com/aquasecurity/trivy/pkg/iac/framework"
"github.com/aquasecurity/trivy/pkg/iac/scan" "github.com/aquasecurity/trivy/pkg/iac/scan"
dftypes "github.com/aquasecurity/trivy/pkg/iac/types" dftypes "github.com/aquasecurity/trivy/pkg/iac/types"

144
pkg/iac/rules/rules.go
View File

@@ -1,79 +1,79 @@
package rules package rules
import ( import (
trules "github.com/aquasecurity/trivy-policies/pkg/rules" trules "github.com/aquasecurity/trivy-checks/pkg/rules"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/accessanalyzer" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/accessanalyzer"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/apigateway" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/apigateway"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/athena" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/athena"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/cloudfront" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/cloudfront"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/cloudtrail" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/cloudtrail"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/cloudwatch" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/cloudwatch"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/codebuild" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/codebuild"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/config" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/config"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/documentdb" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/documentdb"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/dynamodb" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/dynamodb"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/ec2" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/ec2"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/ecr" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/ecr"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/ecs" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/ecs"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/efs" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/efs"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/eks" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/eks"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/elasticache" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/elasticache"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/elasticsearch" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/elasticsearch"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/elb" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/elb"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/emr" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/emr"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/iam" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/iam"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/kinesis" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/kinesis"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/kms" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/kms"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/lambda" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/lambda"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/mq" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/mq"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/msk" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/msk"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/neptune" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/neptune"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/rds" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/rds"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/redshift" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/redshift"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/s3" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/s3"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/sam" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/sam"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/sns" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/sns"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/sqs" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/sqs"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/ssm" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/ssm"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/aws/workspaces" _ "github.com/aquasecurity/trivy-checks/checks/cloud/aws/workspaces"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/appservice" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/appservice"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/authorization" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/authorization"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/compute" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/compute"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/container" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/container"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/database" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/database"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/datafactory" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/datafactory"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/datalake" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/datalake"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/keyvault" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/keyvault"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/monitor" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/monitor"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/network" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/network"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/securitycenter" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/securitycenter"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/storage" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/storage"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/azure/synapse" _ "github.com/aquasecurity/trivy-checks/checks/cloud/azure/synapse"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/cloudstack/compute" _ "github.com/aquasecurity/trivy-checks/checks/cloud/cloudstack/compute"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/digitalocean/compute" _ "github.com/aquasecurity/trivy-checks/checks/cloud/digitalocean/compute"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/digitalocean/spaces" _ "github.com/aquasecurity/trivy-checks/checks/cloud/digitalocean/spaces"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/github/actions" _ "github.com/aquasecurity/trivy-checks/checks/cloud/github/actions"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/github/branch_protections" _ "github.com/aquasecurity/trivy-checks/checks/cloud/github/branch_protections"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/github/repositories" _ "github.com/aquasecurity/trivy-checks/checks/cloud/github/repositories"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/bigquery" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/bigquery"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/compute" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/compute"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/dns" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/dns"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/gke" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/gke"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/iam" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/iam"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/kms" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/kms"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/sql" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/sql"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/google/storage" _ "github.com/aquasecurity/trivy-checks/checks/cloud/google/storage"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/nifcloud/computing" _ "github.com/aquasecurity/trivy-checks/checks/cloud/nifcloud/computing"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/nifcloud/dns" _ "github.com/aquasecurity/trivy-checks/checks/cloud/nifcloud/dns"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/nifcloud/nas" _ "github.com/aquasecurity/trivy-checks/checks/cloud/nifcloud/nas"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/nifcloud/network" _ "github.com/aquasecurity/trivy-checks/checks/cloud/nifcloud/network"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/nifcloud/rdb" _ "github.com/aquasecurity/trivy-checks/checks/cloud/nifcloud/rdb"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/nifcloud/sslcertificate" _ "github.com/aquasecurity/trivy-checks/checks/cloud/nifcloud/sslcertificate"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/openstack/compute" _ "github.com/aquasecurity/trivy-checks/checks/cloud/openstack/compute"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/openstack/networking" _ "github.com/aquasecurity/trivy-checks/checks/cloud/openstack/networking"
_ "github.com/aquasecurity/trivy-policies/checks/cloud/oracle/compute" _ "github.com/aquasecurity/trivy-checks/checks/cloud/oracle/compute"
_ "github.com/aquasecurity/trivy-policies/checks/kubernetes/network" _ "github.com/aquasecurity/trivy-checks/checks/kubernetes/network"
) )
func init() { func init() {

2
pkg/iac/scanners/terraform/module_test.go
View File

@@ -18,7 +18,7 @@ import (
"github.com/aquasecurity/trivy/pkg/iac/terraform" "github.com/aquasecurity/trivy/pkg/iac/terraform"
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
"github.com/aquasecurity/trivy-policies/checks/cloud/aws/iam" "github.com/aquasecurity/trivy-checks/checks/cloud/aws/iam"
) )
var badRule = scan.Rule{ var badRule = scan.Rule{

2
pkg/misconf/scanner.go
View File

@@ -390,7 +390,7 @@ func CreatePolicyFS(policyPaths []string) (fs.FS, []string, error) {
} }
} }
// policy paths are no longer needed as fs.FS contains only needed files now. // check paths are no longer needed as fs.FS contains only needed files now.
policyPaths = []string{"."} policyPaths = []string{"."}
return mfs, policyPaths, nil return mfs, policyPaths, nil

44
pkg/policy/policy.go
View File

@@ -18,8 +18,8 @@ import (
) )
const ( const (
BundleVersion = 0 // Latest released MAJOR version for trivy-policies BundleVersion = 0 // Latest released MAJOR version for trivy-checks
BundleRepository = "ghcr.io/aquasecurity/trivy-policies" BundleRepository = "ghcr.io/aquasecurity/trivy-checks"
policyMediaType = "application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip" policyMediaType = "application/vnd.cncf.openpolicyagent.layer.v1.tar+gzip"
updateInterval = 24 * time.Hour updateInterval = 24 * time.Hour
) )
@@ -46,29 +46,29 @@ func WithClock(c clock.Clock) Option {
// Option is a functional option // Option is a functional option
type Option func(*options) type Option func(*options)
// Client implements policy operations // Client implements check operations
type Client struct { type Client struct {
*options *options
policyDir string policyDir string
policyBundleRepo string checkBundleRepo string
quiet bool quiet bool
} }
// Metadata holds default policy metadata // Metadata holds default check metadata
type Metadata struct { type Metadata struct {
Digest string Digest string
DownloadedAt time.Time DownloadedAt time.Time
} }
func (m Metadata) String() string { func (m Metadata) String() string {
return fmt.Sprintf(`Policy Bundle: return fmt.Sprintf(`Check Bundle:
Digest: %s Digest: %s
DownloadedAt: %s DownloadedAt: %s
`, m.Digest, m.DownloadedAt.UTC()) `, m.Digest, m.DownloadedAt.UTC())
} }
// NewClient is the factory method for policy client // NewClient is the factory method for check client
func NewClient(cacheDir string, quiet bool, policyBundleRepo string, opts ...Option) (*Client, error) { func NewClient(cacheDir string, quiet bool, checkBundleRepo string, opts ...Option) (*Client, error) {
o := &options{ o := &options{
clock: clock.RealClock{}, clock: clock.RealClock{},
} }
@@ -77,22 +77,22 @@ func NewClient(cacheDir string, quiet bool, policyBundleRepo string, opts ...Opt
opt(o) opt(o)
} }
if policyBundleRepo == "" { if checkBundleRepo == "" {
policyBundleRepo = fmt.Sprintf("%s:%d", BundleRepository, BundleVersion) checkBundleRepo = fmt.Sprintf("%s:%d", BundleRepository, BundleVersion)
} }
return &Client{ return &Client{
options: o, options: o,
policyDir: filepath.Join(cacheDir, "policy"), policyDir: filepath.Join(cacheDir, "policy"),
policyBundleRepo: policyBundleRepo, checkBundleRepo: checkBundleRepo,
quiet: quiet, quiet: quiet,
}, nil }, nil
} }
func (c *Client) populateOCIArtifact(registryOpts types.RegistryOptions) error { func (c *Client) populateOCIArtifact(registryOpts types.RegistryOptions) error {
if c.artifact == nil { if c.artifact == nil {
log.Debug("Loading policy bundle", log.String("repository", c.policyBundleRepo)) log.Debug("Loading check bundle", log.String("repository", c.checkBundleRepo))
art, err := oci.NewArtifact(c.policyBundleRepo, c.quiet, registryOpts) art, err := oci.NewArtifact(c.checkBundleRepo, c.quiet, registryOpts)
if err != nil { if err != nil {
return xerrors.Errorf("OCI artifact error: %w", err) return xerrors.Errorf("OCI artifact error: %w", err)
} }
@@ -120,7 +120,7 @@ func (c *Client) DownloadBuiltinPolicies(ctx context.Context, registryOpts types
// Update metadata.json with the new digest and the current date // Update metadata.json with the new digest and the current date
if err = c.updateMetadata(digest, c.clock.Now()); err != nil { if err = c.updateMetadata(digest, c.clock.Now()); err != nil {
return xerrors.Errorf("unable to update the policy metadata: %w", err) return xerrors.Errorf("unable to update the check metadata: %w", err)
} }
return nil return nil
@@ -140,7 +140,7 @@ func (c *Client) LoadBuiltinPolicies() ([]string, error) {
} }
// If the "roots" field is not included in the manifest it defaults to [""] // If the "roots" field is not included in the manifest it defaults to [""]
// which means that ALL data and policy must come from the bundle. // which means that ALL data and check must come from the bundle.
if manifest.Roots == nil || len(*manifest.Roots) == 0 { if manifest.Roots == nil || len(*manifest.Roots) == 0 {
return []string{c.contentDir()}, nil return []string{c.contentDir()}, nil
} }
@@ -153,7 +153,7 @@ func (c *Client) LoadBuiltinPolicies() ([]string, error) {
return policyPaths, nil return policyPaths, nil
} }
// NeedsUpdate returns if the default policy should be updated // NeedsUpdate returns if the default check should be updated
func (c *Client) NeedsUpdate(ctx context.Context, registryOpts types.RegistryOptions) (bool, error) { func (c *Client) NeedsUpdate(ctx context.Context, registryOpts types.RegistryOptions) (bool, error) {
meta, err := c.GetMetadata() meta, err := c.GetMetadata()
if err != nil { if err != nil {
@@ -182,7 +182,7 @@ func (c *Client) NeedsUpdate(ctx context.Context, registryOpts types.RegistryOpt
// Otherwise, if there are no updates in the remote registry, // Otherwise, if there are no updates in the remote registry,
// the digest will be fetched every time even after this. // the digest will be fetched every time even after this.
if err = c.updateMetadata(meta.Digest, time.Now()); err != nil { if err = c.updateMetadata(meta.Digest, time.Now()); err != nil {
return false, xerrors.Errorf("unable to update the policy metadata: %w", err) return false, xerrors.Errorf("unable to update the check metadata: %w", err)
} }
return false, nil return false, nil
@@ -203,7 +203,7 @@ func (c *Client) manifestPath() string {
func (c *Client) updateMetadata(digest string, now time.Time) error { func (c *Client) updateMetadata(digest string, now time.Time) error {
f, err := os.Create(c.metadataPath()) f, err := os.Create(c.metadataPath())
if err != nil { if err != nil {
return xerrors.Errorf("failed to open a policy manifest: %w", err) return xerrors.Errorf("failed to open a check manifest: %w", err)
} }
defer f.Close() defer f.Close()
@@ -222,14 +222,14 @@ func (c *Client) updateMetadata(digest string, now time.Time) error {
func (c *Client) GetMetadata() (*Metadata, error) { func (c *Client) GetMetadata() (*Metadata, error) {
f, err := os.Open(c.metadataPath()) f, err := os.Open(c.metadataPath())
if err != nil { if err != nil {
log.Debug("Failed to open the policy metadata", log.Err(err)) log.Debug("Failed to open the check metadata", log.Err(err))
return nil, err return nil, err
} }
defer f.Close() defer f.Close()
var meta Metadata var meta Metadata
if err = json.NewDecoder(f).Decode(&meta); err != nil { if err = json.NewDecoder(f).Decode(&meta); err != nil {
log.Warn("Policy metadata decode error", log.Err(err)) log.Warn("Check metadata decode error", log.Err(err))
return nil, err return nil, err
} }
@@ -237,9 +237,9 @@ func (c *Client) GetMetadata() (*Metadata, error) {
} }
func (c *Client) Clear() error { func (c *Client) Clear() error {
log.Info("Removing policy bundle...") log.Info("Removing check bundle...")
if err := os.RemoveAll(c.policyDir); err != nil { if err := os.RemoveAll(c.policyDir); err != nil {
return xerrors.Errorf("failed to remove policy bundle: %w", err) return xerrors.Errorf("failed to remove check bundle: %w", err)
} }
return nil return nil
} }

2
pkg/policy/policy_test.go
View File

@@ -243,7 +243,7 @@ func TestClient_NeedsUpdate(t *testing.T) {
}, },
}, nil) }, nil)
// Create a policy directory // Create a check directory
err := os.MkdirAll(filepath.Join(tmpDir, "policy"), os.ModePerm) err := os.MkdirAll(filepath.Join(tmpDir, "policy"), os.ModePerm)
require.NoError(t, err) require.NoError(t, err)

4
pkg/result/filter_test.go
View File

@@ -570,7 +570,7 @@ func TestFilter(t *testing.T) {
Vulnerabilities: []types.DetectedVulnerability{ Vulnerabilities: []types.DetectedVulnerability{
vuln1, vuln1,
vuln2, // ignored by severity vuln2, // ignored by severity
vuln3, // ignored by policy vuln3, // ignored by check
}, },
}, },
}, },
@@ -606,7 +606,7 @@ func TestFilter(t *testing.T) {
Misconfigurations: []types.DetectedMisconfiguration{ Misconfigurations: []types.DetectedMisconfiguration{
misconf1, misconf1,
misconf2, misconf2,
misconf3, // ignored by policy misconf3, // ignored by check
}, },
}, },
}, },

2
pkg/rpc/server/listen_test.go
View File

@@ -306,7 +306,7 @@ func Test_VersionEndpoint(t *testing.T) {
UpdatedAt: time.Date(2023, 7, 20, 12, 11, 37, 696263932, time.UTC), UpdatedAt: time.Date(2023, 7, 20, 12, 11, 37, 696263932, time.UTC),
DownloadedAt: time.Date(2023, 7, 25, 7, 1, 41, 239158000, time.UTC), DownloadedAt: time.Date(2023, 7, 25, 7, 1, 41, 239158000, time.UTC),
}, },
PolicyBundle: &policy.Metadata{ CheckBundle: &policy.Metadata{
Digest: "sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43", Digest: "sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43",
DownloadedAt: time.Date(2023, 7, 23, 16, 40, 33, 122462000, time.UTC), DownloadedAt: time.Date(2023, 7, 23, 16, 40, 33, 122462000, time.UTC),
}, },

8
pkg/version/version.go
View File

@@ -22,7 +22,7 @@ type VersionInfo struct {
Version string `json:",omitempty"` Version string `json:",omitempty"`
VulnerabilityDB *metadata.Metadata `json:",omitempty"` VulnerabilityDB *metadata.Metadata `json:",omitempty"`
JavaDB *metadata.Metadata `json:",omitempty"` JavaDB *metadata.Metadata `json:",omitempty"`
PolicyBundle *policy.Metadata `json:",omitempty"` CheckBundle *policy.Metadata `json:",omitempty"`
} }
func formatDBMetadata(title string, meta metadata.Metadata) string { func formatDBMetadata(title string, meta metadata.Metadata) string {
@@ -42,8 +42,8 @@ func (v *VersionInfo) String() string {
if v.JavaDB != nil { if v.JavaDB != nil {
output += formatDBMetadata("Java DB", *v.JavaDB) output += formatDBMetadata("Java DB", *v.JavaDB)
} }
if v.PolicyBundle != nil { if v.CheckBundle != nil {
output += v.PolicyBundle.String() output += v.CheckBundle.String()
} }
return output return output
} }
@@ -102,6 +102,6 @@ func NewVersionInfo(cacheDir string) VersionInfo {
Version: ver, Version: ver,
VulnerabilityDB: dbMeta, VulnerabilityDB: dbMeta,
JavaDB: javadbMeta, JavaDB: javadbMeta,
PolicyBundle: pbMeta, CheckBundle: pbMeta,
} }
} }

4
pkg/version/version_test.go
View File

@@ -26,7 +26,7 @@ func Test_BuildVersionInfo(t *testing.T) {
UpdatedAt: time.Date(2023, 7, 25, 1, 3, 52, 169192765, time.UTC), UpdatedAt: time.Date(2023, 7, 25, 1, 3, 52, 169192765, time.UTC),
DownloadedAt: time.Date(2023, 7, 25, 9, 37, 48, 906152000, time.UTC), DownloadedAt: time.Date(2023, 7, 25, 9, 37, 48, 906152000, time.UTC),
}, },
PolicyBundle: &policy.Metadata{ CheckBundle: &policy.Metadata{
Digest: "sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43", Digest: "sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43",
DownloadedAt: time.Date(2023, 7, 23, 16, 40, 33, 122462000, time.UTC), DownloadedAt: time.Date(2023, 7, 23, 16, 40, 33, 122462000, time.UTC),
}, },
@@ -46,7 +46,7 @@ Java DB:
UpdatedAt: 2023-07-25 01:03:52.169192765 +0000 UTC UpdatedAt: 2023-07-25 01:03:52.169192765 +0000 UTC
NextUpdate: 2023-07-28 01:03:52.169192565 +0000 UTC NextUpdate: 2023-07-28 01:03:52.169192565 +0000 UTC
DownloadedAt: 2023-07-25 09:37:48.906152 +0000 UTC DownloadedAt: 2023-07-25 09:37:48.906152 +0000 UTC
Policy Bundle: Check Bundle:
Digest: sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43 Digest: sha256:829832357626da2677955e3b427191212978ba20012b6eaa03229ca28569ae43
DownloadedAt: 2023-07-23 16:40:33.122462 +0000 UTC DownloadedAt: 2023-07-23 16:40:33.122462 +0000 UTC
` `