8.9. 扫描容器和容器镜像中的漏洞

流程

1. 查找容器或容器镜像的 ID，例如：

   ~]# docker images
   REPOSITORY                            TAG      IMAGE ID       CREATED       SIZE
   registry.access.redhat.com/ubi7/ubi   latest   096cae65a207   7 weeks ago   239 MB
   

2. 扫描容器或容器镜像的漏洞，并将结果保存到 vulnerability.html 文件中：

   ~]# oscap-docker image-cve 096cae65a207 --report vulnerability.html

   重要
   要扫描容器，请将 image-cve 参数替换为 container-cve。

验证

1. 在您选择的浏览器中检查结果，例如：

   ~]$ firefox vulnerability.html &

流程

1. 验证您是否具有最新的 OpenSCAP 容器镜像，以确保定义是最新的：

   ~]# atomic help registry.access.redhat.com/rhel7/openscap | grep version 

2. 扫描带有几个已知的安全漏洞的 RHEL 7.2 容器镜像：

   ~]# atomic scan registry.access.redhat.com/rhel7:7.2 
   docker run -t --rm -v /etc/localtime:/etc/localtime -v /run/atomic/2017-11-01-14-49-36-614281:/scanin -v /var/lib/atomic/openscap/2017-11-01-14-49-36-614281:/scanout:rw,Z -v /etc/oscapd:/etc/oscapd:ro registry.access.redhat.com/rhel7/openscap oscapd-evaluate scan --no-standard-compliance --targets chroots-in-dir:///scanin --output /scanout
   
   registry.access.redhat.com/rhel7:7.2 (98a88a8b722a718)
   
   The following issues were found:
   
    RHSA-2017:2832: nss security update (Important)
    Severity: Important
   	 RHSA URL: https://access.redhat.com/errata/RHSA-2017:2832
   	 RHSA ID: RHSA-2017:2832-01
   	 Associated CVEs:
   			 CVE ID: CVE-2017-7805
   			 CVE URL: https://access.redhat.com/security/cve/CVE-2017-7805
   ...