Welcome to Support Portal

TABLE OF CONTENTS

• Overview
• High-level structure
• Overall evaluation of custom compliance
• Filesearch
  • Script overview
  • Audit section
  • Tests section
  • Other sections
• Textsearch
• Example: check_netcat_installed_image.ab

Overview

Aqua Bench custom compliance checks allow static validation of files or text content within a container image. Aqua Bench custom compliance scripts (compliance checks) are customizable pieces of code in the form of YAML files, supporting a syntax similar to that of the Linux find and grep commands. The scripts must be saved with file type .ab. Aqua Bench is supported in direct scanning mode only.

This topic describes the Aqua Bench script syntax. It is recommended that you view the predefined Aqua Bench scripts at the Policies > Assurance Policies > Compliance Checks page as explained in the Custom Compliance Checks for Image Assurance Policies document.

High-level structure

Following is the high-level structure of an Aqua Bench script file:

description: "< your description >"
groups:
  - id: 1
    checks:
      - id: 1.1
        [ Filesearch or Textsearch syntax ]
      - id: 1.2
      ...
  - id: 2
    ...
  ...
  - id: N        

• id: followed by a first-level sequence number (n)
• checks: the inner level contains one or more groups of rows under this
  • The first row is - id: followed by a second-level sequence number (n.m).
  • The innermost loop (id:n.m) should have a specific check in one of the following formats, as explained below:
    • Filesearch: tests for the existence (or absence) of certain files in an image, based on the file name
    • Textsearch: tests for the existence (or absence) of certain text strings within files in an image

Overall evaluation of custom compliance

The structure described above allows for the definition of multiple specific checks, each related to the existence (or absence) of files or text within an image. The Custom Compliance Checks control will pass only if every single check in the script passes. If any of he checks fail, the control will fail the image compliance.

For simplicity, flexibility, and legibility, it is recommended to keep the number of checks within any given Aqua Bench script to as minimum as possible. Note that the Custom Compliance Checks control can include multiple Aqua Bench scripts.

Filesearch

Script overview

The script under the innermost loop row id n.m is of the format shown in the following text box. The script has the following two major sections:

• audit: This section of a filesearch test specifies the search criteria.
• tests: section defines the format of the search output, and instructs the filesearch test how to process the output, which is a list of all files that correspond to the search criteria specified. There are two levels under the tests section.

Passing rows that are not mandatory always, are marked as optional for audit and tests sections, in the row description tables below.

Following is the sample script for Aqua Bench - filesearch type, having all of the rows that can be passed:

        audittype: "filesearch"
        audit:
          path: "/"
          fileType: [ "file" | "directory" | "symblink" ]
          searchTerm: "< search term >"
          searchType: [ "exact" | "contains" | "hasPrefix" | "hasSuffix" ]
          perm: "nnn"
          groupId: "nnn"
          userId: "nnn"
        tests:
          test_items:
             - compare:
                 count: [ false | true ]
                 op: [ "eq" | "noteq" | "gt" | "gte" ]
                 value: "< comparison value >"
               set: [ true | false ]
        remediation: "< specify the action to remediate if specified is found >"
        scored: [ true | false ]

Tests section

Following table explains the description to each row that can be passed in the tests section. Some of the rows are marked as optional to mark that passing them is not mandatory always.

Other sections

Following table explains description to the row, scored. Passing this row is optional.

Textsearch

Following is the sample script for Aqua Bench - textsearch type, having all of the rows that can be passed:

        audittype: "textsearch"
        audit:
          path: "/"
          fileType: [ "file" | "directory" | "symblink" ]
          searchTerm: "< search term >"
          searchType: [ "exact" | "contains" | "hasPrefix" | "hasSuffix" ]
          perm: "nnn"
          groupId: "nnn"
          userId: "nnn"
        tests:
          test_items:
             - compare:
                 count: [ false | true ]
                 op: [ "eq" | "noteq" | "gt" | "gte" ]
                 value: "< comparison value >"
               set: [ true | false ]
        remediation: "< specify the action to remediate if specified is found >"
        scored: [ true | false ]

Example: check_netcat_installed_image.ab

This script is predefined in Aqua. It searches for all files (filesearch) in the root directory whose names are exactly "nc". Since count is false, the script compares the list of files corresponding to the search criteria (which means, the list of files named "nc") with the null string. If the test fails (meaning there is at least one file named "nc"), the test and Custom Compliance Checks control will fail. 

description: "This test looks for netcat 'nc' executable and fails if it is found"
groups:
  - id: 1
    checks:
      - id: 1.1
        audittype: "filesearch"
        audit:
          path: "/"
          searchTerm: "nc"
          searchType: "exact"
        tests:
          test_items:
             - compare:
                 op: "eq"
                 value: ""
               set: true
        remediation: "Uninstall netcat"
        scored: true