docker-bench-security icon indicating copy to clipboard operation
docker-bench-security copied to clipboard

[Bug] 1.1.5 doesn't take into account a changed data-root

Open OdinVex opened this issue 11 months ago • 2 comments

I've changed data-root in Docker's daemon.json to a new partition and location but test 1.1.5 doesn't take that into account and still assumes to look for /var/lib/docker...

I believe 1.1.5 should only assume /var/lib/docker if the daemon.json hasn't been found or has an empty data-root, otherwise it should use that path.

(Edit: Or wherever Docker's pulling the config/parameter from.)

OdinVex avatar Feb 02 '25 19:02 OdinVex

Hi @OdinVex, this is to comply with "1.1.5 Ensure auditing is configured for Docker files and directories - /var/lib/docker" which is in the CIS Docker benchmark. I've added a proposal to use the data-root settings instead of a static link.

konstruktoid avatar Feb 03 '25 22:02 konstruktoid

Hi @OdinVex, this is to comply with "1.1.5 Ensure auditing is configured for Docker files and directories - /var/lib/docker" which is in the CIS Docker benchmark. I've added a proposal to use the data-root settings instead of a static link.

That is indeed what I meant, yes, that 1.1.5 should be updated to allow for data-root having been changed. Thank you very much for the proposal.

OdinVex avatar Feb 03 '25 22:02 OdinVex