Chapter 3. Clair security scanner

Procedure

1. Install the clairctl program for a Clair deployment in an OpenShift Container Platform cluster by entering the following command:

   $ oc -n quay-enterprise exec example-registry-clair-app-64dd48f866-6ptgw -- cat /usr/bin/clairctl > clairctl

   Copy to Clipboard Toggle word wrap
   Note

   Unofficially, the clairctl tool can be downloaded

2. Set the permissions of the clairctl file so that it can be executed and run by the user, for example:

   $ chmod u+x ./clairctl

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following command to retrieve and decode the configuration secret, and then save it to a Clair configuration YAML:

   $ oc get secret -n quay-enterprise example-registry-clair-config-secret  -o "jsonpath={$.data['config\.yaml']}" | base64 -d > clair-config.yaml

   Copy to Clipboard Toggle word wrap

2. Update the clair-config.yaml file so that the disable_updaters and airgap parameters are set to True, for example:

   ---
   indexer:
     airgap: true
   ---
   matcher:
     disable_updaters: true
   ---

   Copy to Clipboard Toggle word wrap

Procedure

1. Determine your Clair database service by using the oc CLI tool, for example:

   $ oc get svc -n quay-enterprise

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                  TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                             AGE
   example-registry-clair-app            ClusterIP      172.30.224.93    <none>        80/TCP,8089/TCP                     4d21h
   example-registry-clair-postgres       ClusterIP      172.30.246.88    <none>        5432/TCP                            4d21h
   ...

   Copy to Clipboard Toggle word wrap

2. Forward the Clair database port so that it is accessible from the local machine. For example:

   $ oc port-forward -n quay-enterprise service/example-registry-clair-postgres 5432:5432

   Copy to Clipboard Toggle word wrap

3. Update your Clair config.yaml file, for example:

   indexer:
       connstring: host=localhost port=5432 dbname=postgres user=postgres password=postgres sslmode=disable 

   1

   
       layer_scan_concurrency: 5
       migrations: true
       scanlock_retry: 10
       airgap: true
       scanner:
         repo:
           rhel-repository-scanner: 

   2

   
             repo2cpe_mapping_file: /data/repository-to-cpe.json
         package:
           rhel_containerscanner: 

   3

   
             name2repos_mapping_file: /data/container-name-repos-map.json

   Copy to Clipboard Toggle word wrap

   1

   Replace the value of the host in the multiple connstring fields with localhost.

   2

   For more information about the rhel-repository-scanner parameter, see "Mapping repositories to Common Product Enumeration information".

   3

   For more information about the rhel_containerscanner parameter, see "Mapping repositories to Common Product Enumeration information".

Procedure

1. Install the clairctl program for a self-managed Clair deployment by using the podman cp command, for example:

   $ sudo podman cp clairv4:/usr/bin/clairctl ./clairctl

   Copy to Clipboard Toggle word wrap

2. Set the permissions of the clairctl file so that it can be executed and run by the user, for example:

   $ chmod u+x ./clairctl

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a folder for your Clair configuration file, for example:

   $ mkdir /etc/clairv4/config/

   Copy to Clipboard Toggle word wrap

2. Create a Clair configuration file with the disable_updaters parameter set to True, for example:

   ---
   indexer:
     airgap: true
   ---
   matcher:
     disable_updaters: true
   ---

   Copy to Clipboard Toggle word wrap

3. Start Clair by using the container image, mounting in the configuration from the file you created:

   $ sudo podman run -it --rm --name clairv4 \
   -p 8081:8081 -p 8088:8088 \
   -e CLAIR_CONF=/clair/config.yaml \
   -e CLAIR_MODE=combo \
   -v /etc/clairv4/config:/clair:Z \
   registry.redhat.io/quay/clair-rhel8:v3.15.2

   Copy to Clipboard Toggle word wrap

Procedure

1. Determine your Clair database service by using the oc CLI tool, for example:

   $ oc get svc -n quay-enterprise

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                  TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                             AGE
   example-registry-clair-app            ClusterIP      172.30.224.93    <none>        80/TCP,8089/TCP                     4d21h
   example-registry-clair-postgres       ClusterIP      172.30.246.88    <none>        5432/TCP                            4d21h
   ...

   Copy to Clipboard Toggle word wrap

2. Forward the Clair database port so that it is accessible from the local machine. For example:

   $ oc port-forward -n quay-enterprise service/example-registry-clair-postgres 5432:5432

   Copy to Clipboard Toggle word wrap

3. Update your Clair config.yaml file, for example:

   indexer:
       connstring: host=localhost port=5432 dbname=postgres user=postgres password=postgres sslmode=disable 

   1

   
       layer_scan_concurrency: 5
       migrations: true
       scanlock_retry: 10
       airgap: true
       scanner:
         repo:
           rhel-repository-scanner: 

   2

   
             repo2cpe_mapping_file: /data/repository-to-cpe.json
         package:
           rhel_containerscanner: 

   3

   
             name2repos_mapping_file: /data/container-name-repos-map.json

   Copy to Clipboard Toggle word wrap

   1

   Replace the value of the host in the multiple connstring fields with localhost.

   2

   For more information about the rhel-repository-scanner parameter, see "Mapping repositories to Common Product Enumeration information".

   3

   For more information about the rhel_containerscanner parameter, see "Mapping repositories to Common Product Enumeration information".