turbot/docker_compliance

Query: exec_containers_no_new_privilege_disabled

Usage

powerpipe query docker_compliance.query.exec_containers_no_new_privilege_disabled

Steampipe Tables

SQL

with hostname as (
select
btrim(stdout_output, E ' \n\r\t') as host,
_ctx ->> 'connection_name' as host_conn,
_ctx
from
exec_command
where
command = 'hostname'
),
command_output as (
select
stdout_output,
_ctx ->> 'connection_name' as conn
from
exec_command
where
command = 'ps -ef | grep dockerd'
)
select
host as resource,
case
when o.stdout_output like '%--no-new-privileges=false%' then 'alarm'
when o.stdout_output not like '%--no-new-privileges%' then 'alarm'
else 'ok'
end as status,
case
when o.stdout_output like '%--no-new-privileges=false%' then host || ' no new privileges is disabled.'
when o.stdout_output not like '%--no-new-privileges%' then host || ' no new privileges not set.'
else host || ' no new privilege is enabled.'
end as reason,
h._ctx ->> 'connection_name' as connection_name
from
hostname as h,
command_output as o
where
h.host_conn = o.conn;

Controls

The query is being used by the following controls: