57 lines
2.2 KiB
Diff
57 lines
2.2 KiB
Diff
From 532a6c77f388d2e06ec12338df9ea97d955f5edc Mon Sep 17 00:00:00 2001
|
|
From: Matus Marhefka <mmarhefk@redhat.com>
|
|
Date: Thu, 16 Jan 2020 15:39:37 +0100
|
|
Subject: [PATCH] utils/oscap-podman: Detect ambiguous scan target
|
|
|
|
In case that a container image and a running container have the same
|
|
name, `oscap-podman` scans container image and a running container is
|
|
skipped. This might be unexpected and might cause a confusion for user.
|
|
Therefore, this commit adds a code which detects such situation and
|
|
rather informs user about ambiguous scan target and terminates.
|
|
In such cases the unique container image/container ID should be used
|
|
for specifying the target of the scan.
|
|
---
|
|
utils/oscap-podman | 23 ++++++++++++++++++-----
|
|
1 file changed, 18 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/utils/oscap-podman b/utils/oscap-podman
|
|
index 272afd988..32ec0cfcb 100755
|
|
--- a/utils/oscap-podman
|
|
+++ b/utils/oscap-podman
|
|
@@ -65,17 +65,30 @@ if grep -q "\-\-remediate" <<< "$@"; then
|
|
die
|
|
fi
|
|
|
|
+IMAGE_NAME=$(podman image exists "$1" \
|
|
+ && podman image inspect --format "{{.Id}} {{.RepoTags}}" "$1")
|
|
+CONTAINER_NAME=$(podman container exists "$1" \
|
|
+ && podman container inspect --format "{{.Id}} {{.Name}}" "$1")
|
|
+
|
|
+if [ -n "$IMAGE_NAME" ] && [ -n "$CONTAINER_NAME" ]; then
|
|
+ echo "Ambiguous target, container image and container with the same name detected: '$1'." >&2
|
|
+ echo "Please rather use an unique ID to specify the target of the scan." >&2
|
|
+ die
|
|
+fi
|
|
+
|
|
# Check if the target of scan is image or container.
|
|
CLEANUP=0
|
|
-if podman images | grep -q $1; then
|
|
+if [ -n "$IMAGE_NAME" ]; then
|
|
ID=$(podman create $1) || die
|
|
- IMG_NAME=$(podman images --format "{{.ID}} ({{.Repository}}:{{.Tag}})" | grep -m1 $1)
|
|
- TARGET="podman-image://$IMG_NAME"
|
|
+ TARGET="podman-image://$IMAGE_NAME"
|
|
CLEANUP=1
|
|
-else
|
|
+elif [ -n "$CONTAINER_NAME" ]; then
|
|
# If the target was not found in images we suppose it is a container.
|
|
ID=$1
|
|
- TARGET="podman-container://$1"
|
|
+ TARGET="podman-container://$CONTAINER_NAME"
|
|
+else
|
|
+ echo "Target of the scan not found: '$1'." >&2
|
|
+ die
|
|
fi
|
|
|
|
# podman init creates required files such as: /run/.containerenv - we don't care about output and exit code
|