lukebond / microscanner-wrapper Goto Github PK

Bash wrapper script for Aquasec Microscanner

License: Apache License 2.0

Shell 100.00%

microscanner-wrapper's Introduction

Aquasec Microscanner Wrapper

Use this script to scan images with Aquasec Microscanner.

Why? Because Microscanner requires you to extend your image by adding Microscanner rather than being able to scan images you've already built.

First Register for a Token

As per instructions here: https://github.com/aquasecurity/microscanner

Usage

Simply pass your token as an environment variable and the Docker image as the only argument:

$ MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx ./scan.sh DOCKER_IMAGE

For example, one that passes:

$ MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx ./scan.sh aquasec/microscanner

...and one that fails:

$ MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx ./scan.sh ubuntu:16.04

The script will return 0 if Microscanner passes the image, or 1 if it fails it.

Local microscanner

To avoid pulling the microscanner, if it's available in the local path:

$ USE_LOCAL=1 MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx ./scan.sh ubuntu:16.04

Optional Parameters

To run miscroscanner with optional parameters simply add MICROSCANNER_OPTIONS as an environmental or as one argument:

$ MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx MICROSCANNER_OPTIONS="--html" ./scan.sh DOCKER_IMAGE

Output HTML

To output the results in HTML simply call this script with the same familar parameters:

$ MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx ./grabhtml.sh DOCKER_IMAGE

microscanner-wrapper's People

Contributors

Stargazers

Watchers

microscanner-wrapper's Issues

Expose report

Microscanner produces a report; this tool should export it

grabhtml misses </html> at the end

Please change the sed command to include </html>
thanks.

ERROR: failed fetching server information: request failed: Get https://microscanner.aquasec.com/api:

even if you try to access https://microscanner.aquasec.com it says site is down,
unable to scan image

Text file busy

Hi,

When I execute:

$ MICROSCANNER_TOKEN=xxxxxxxxxxxxxxxx ./scan.sh DOCKER_IMAGE

I get:

Step 5/5 : RUN [ -x /tmp/microscanner ] || chmod +x /tmp/microscanner   && /tmp/microscanner --version   && /tmp/microscanner xxxxxxxxxxxxxxxx
 ---> Running in a34ecd9ecae2
/bin/sh: 1: /tmp/microscanner: Text file busy

unable to prepare context: unable to evaluate symlinks in Dockerfile path: lstat /tmp/tmp.1hhfsS1G6c/-: no such file or directory

my host:

cat /etc/issue
Debian GNU/Linux 7 \n \l

uname -a
Linux sa-vms-01 3.16.0-0.bpo.4-amd64 #1 SMP Debian 3.16.39-1+deb8u1~bpo70+1 (2017-02-24) x86_64 GNU/Linux

when running script like > MICROSCANNER_TOKEN=xxx ./scan.sh <docker_image> error raises:

 cat
unable to prepare context: unable to evaluate symlinks in Dockerfile path: lstat /tmp/tmp.1hhfsS1G6c/-: no such file or directory
+ cleanup
+ docker inspect --type=image kgaoolrbot0nc6pahx2pdamjbugxb2zn
+ rm -rf /tmp/tmp.1hhfsS1G6c

USE_LOCAL=1 MICROSCANNER_TOKEN=*** ./scan.sh bkimminich/juice-shop
which: no microscanner in (/sbin:/sbin:/bin:/usr/sbin:/usr/bin)
Sending build context to Docker daemon 2.095kB
Step 1/5 : FROM bkimminich/juice-shop
---> 343934d04e44
Step 2/5 : RUN if [ ! -d /etc/ssl/certs/ ] || { [ ! -f /etc/ssl/certs/ca-certificates.crt ] && [ ! -f /etc/ssl/certs/ca-bundle.crt ]; }; then PACKAGE_MANAGER=$(basename $({ command -v apk apt yum false 2>/dev/null || which apk apt yum false; } | head -n1)); if [ "${PACKAGE_MANAGER}" = "apk" ]; then apk --update add ca-certificates; elif [ "${PACKAGE_MANAGER}" = "apt" ]; then apt update && apt install --no-install-recommends -y ca-certificates && update-ca-certificates; elif [ "${PACKAGE_MANAGER}" = "yum" ]; then yum install -y ca-certificates; else echo 'ca-certificates not found and package manager not apk, apt, or yum. Aborting' >&2; exit 1; fi; fi;
---> Running in 32b797186633
ERROR: Unable to lock database: Permission denied
ERROR: Failed to open apk database: Permission denied
Removing intermediate container 32b797186633
The command '/bin/sh -c if [ ! -d /etc/ssl/certs/ ] || { [ ! -f /etc/ssl/certs/ca-certificates.crt ] && [ ! -f /etc/ssl/certs/ca-bundle.crt ]; }; then PACKAGE_MANAGER=$(basename $({ command -v apk apt yum false 2>/dev/null || which apk apt yum false; } | head -n1)); if [ "${PACKAGE_MANAGER}" = "apk" ]; then apk --update add ca-certificates; elif [ "${PACKAGE_MANAGER}" = "apt" ]; then apt update && apt install --no-install-recommends -y ca-certificates && update-ca-certificates; elif [ "${PACKAGE_MANAGER}" = "yum" ]; then yum install -y ca-certificates; else echo 'ca-certificates not found and package manager not apk, apt, or yum. Aborting' >&2; exit 1; fi; fi;' returned a non-zero code: 99

Make use of local microscanner binary explicit

At present it will silently pick up local if it's there. Perhaps a cmdline arg or an envvar such as USE_LOCAL_MICROSCANNER which defaults to 0/false.