"Ensure a separate partition for containers has been created" is logged although separate is created.

[RahulMetangale]

I am using ubuntu 16.04 with docker version
Docker version 18.06.1-ce, build e68fc7a

I have created a separate partition for docker still security check warns about 1.1.

Here is the output of docker info command
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 0
Server Version: 18.06.1-ce
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 468a545b9edcd5932818eb9de8e72413e616e86e
runc version: 69663f0bd4b60df09991c08812a60108003fa340
init version: fec3683
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 4.15.0-1025-azure
Operating System: Ubuntu 16.04.5 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 27.48GiB
Name: AZLXSPTAPTDEVAP01
ID: IM4B:T3UU:O5S3:AAPG:A7UX:5VKM:434G:SKQO:M4AE:MERS:MMTJ:JBLU
Docker Root Dir: /datadrive/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support

[konstruktoid]

Hi @RahulMetangale, you're correct.
We only check for /var/lib/docker, https://github.com/docker/docker-bench-security/blob/master/tests/1_host_configuration.sh#L21-L28.
I'll make it more dynamic.

[konstruktoid]

I believe this has been fixed, could you test #333?

[RahulMetangale]

@konstruktoid Thank you for your quick response. I checked out pull request 333. still seeing the same issue.

[konstruktoid]

@RahulMetangale, could you post the output of mountpoint -- "$(sudo docker info -f '{{ .DockerRootDir }}')" and grep "$(sudo docker info -f '{{ .DockerRootDir }}')" /proc/mounts.

[RahulMetangale]

@konstruktoid here is the output
mountpoint -- "$(sudo docker info -f '{{ .DockerRootDir }}')"
/datadrive/docker is not a mountpoint

grep "$(sudo docker info -f '{{ .DockerRootDir }}')" /proc/mounts
overlay /datadrive/docker/overlay2/e1420d39ecc2c1977b3af3fc196c2f4d80e1a3f5a23601bwrere391884d00668f/merged overlay rw,relatime,lowerdir=/datadrive/docker/overlay2/l/ASN2T4SXPT4HEYUIR2DQ5KXWQS:/datadrive/docker/overlay2/l/RHVXPHPEIILXT5SDQLODJ6V6R5,upperdir=/datadrive/docker/overlay2/e1420d39ecc2c1977b3af3fc196c2f4d80e1a3f5a23601bwrere391884d00668f/diff,workdir=/datadrive/docker/overlay2/e1420d39ecc2c1977b3af3fc196c2f4d80e1a3f5a23601bwrere391884d00668f/work 0 0
shm /datadrive/docker/containers/ab72234f135d0368987ab9eb932d7af74edb89ff3ec736553b37b0d0a7c02180/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0
overlay /datadrive/docker/overlay2/a715c8aad9f973195e06d8780d6f3f8fd825d46995ee26c6d21345b795552979/merged overlay rw,relatime,lowerdir=/datadrive/docker/overlay2/l/HVN3COX6S35IWOB552HOHGWDQO:/datadrive/docker/overlay2/l/FPBDUN5CVZLWTBFLGITPDPW3C3:/datadrive/docker/overlay2/l/4NTLHYL5TJCIEJ4EXERYNPYOYO:/datadrive/docker/overlay2/l/B6GIYFLDQ4TYWXATZ6PEQDSHIY:/datadrive/docker/overlay2/l/KO5WFDQ5WNSJ3EC423RI2VT576:/datadrive/docker/overlay2/l/I3Z3W243O4X26N2WJ6AAEM6PXS:/datadrive/docker/overlay2/l/Z7ILI5BFSBD7HG3TOJ7I2CX6UV:/datadrive/docker/overlay2/l/KGCXNEDSKI6ECXL7Y4SLT6BJC7:/datadrive/docker/overlay2/l/YLM67ID6X3L3IECVTAMIHFRSZQ:/datadrive/docker/overlay2/l/AFTGJEA5VFDSLRS53HTEMN2OVR:/datadrive/docker/overlay2/l/6G26DJ4M7HRO6PRRELDDJLPLNS:/datadrive/docker/overlay2/l/K66Z2I2VX4V4N7HWXC5G7VMYHF:/datadrive/docker/overlay2/l/ILM4WLK6SK3ZDFQYL6QKTM6USQ:/datadrive/docker/overlay2/l/O6XP5SFPH4EIVAVOPWQ5LOCJLC:/datadrive/docker/overlay2/l/MXFOMK6OMBAPCF4S5JZ6OHPQK6 /datadrive/docker/overlay2/l/RODJOZZQF4V6R7ALCD2OYCDISW:/datadrive/docker/overlay2/l/OLN2TYIBTVIRQJSCEAONF4PFFA:/datadrive/docker/overlay2/l/XF7ZNUEMFHMAW3DW2TC75HF5TN:/datadrive/docker/overlay2/l/R225HDTCMZDPBNWFQMFH7LNVIC:/datadrive/docker/overlay2/l/6NXZYAYCPRCHGJUEDI53GUHO7Y,upperdir=/datadrive/docker/overlay2/a715c8aad9f973195e06d8780d6f3f8fd825d46995ee26c6d21345b795552979/diff,workdir=/datadrive/docker/overlay2/a715c8aad9f973195e06d8780d6f3f8fd825d46995ee26c6d21345b795552979/work 0 0
shm /datadrive/docker/containers/8257cb4301080222176f9d2b54c29238ee38b5637d83cf664aeb4470e75936d5/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0
overlay /datadrive/docker/overlay2/94d2830dbd755496abdb9935c8c2b313de1ed09c38fb383d5961f2ec8fbb98e8/merged overlay rw,relatime,lowerdir=/datadrive/docker/overlay2/l/FXHLGVPNYENW32KM22XQJ4MGKJ:/datadrive/docker/overlay2/l/7V5MACM3YRELZG6KYJLF74BGON:/datadrive/docker/overlay2/l/FFGQJT3TSBGXZEWW7HJN5MN3OZ:/datadrive/docker/overlay2/l/ZKY6TQY54CPLTKYQZVFHYCZ4HM,upperdir=/datadrive/docker/overlay2/94d2830dbd755496abdb9935c8c2b313de1ed09c38fb383d5961f2ec8fbb98e8/diff,workdir=/datadrive/docker/overlay2/94d2830dbd755496abdb9935c8c2b313de1ed09c38fb383d5961f2ec8fbb98e8/work 0 0
shm /datadrive/docker/containers/b1c9ecd4faddb6d50ef6a35b3741959cebad9b32fc6e3daa944afa905eb4ff93/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0

[konstruktoid]

/datadrive/docker is not a mountpoint and since it doesn't show up in /proc/mounts as a separate partition, it seems it's just a directory.

[RahulMetangale]

if i run following command
mountpoint -- '/datadrive'
then it does return expected output
/datadrive is a mountpoint

but now understand what issue is. I have created a directory on the mountpoint with the name 'docker' which is being used as docker root directory.

mkdir datadrive
mount /dev/sdc1 /datadrive
cd /datadrive
mkdir docker

Hence datadrive is mountpoint but /datadrive/docker is not.

Thanks for the pointer. I will work on this.

[soulawaker]

In my case, I made a new partition, mount it, copied /var/lib/docker to it, umount it, removed /var/lib/docker and mount the new partition /var/lib/docker. Now /var/lib/docker is checked a mount point with mountpoint command but it is not with docker-bench-security.

[konstruktoid]

Hi @soulawaker, could you post the output of mountpoint -- "$(sudo docker info -f '{{ .DockerRootDir }}')" and grep "$(sudo docker info -f '{{ .DockerRootDir }}')" /proc/mounts as well?

[soulawaker]

Ah, yes. I post them.

$ mountpoint -- "$(sudo docker info -f '{{ .DockerRootDir }}')"
/var/lib/docker/231072.231072 is not a mountpoint
$ grep "$(sudo docker info -f '{{ .DockerRootDir }}')" /proc/mounts
...nothing... 

[konstruktoid]

@soulawaker as you can see /var/lib/docker/231072.231072 is not a partition, but a standard directory.

[soulawaker]

@konstruktoid I thought isolating /var/lib/docker to another partition should be satisfied with security check 1.1. Am I missing any points?

[konstruktoid]

@soulawaker partially, but this is just as a spamming app will fill /var when it writes to /var/log if /var/log is a directory (as /var/lib/docker/231072.231072 is a directory under /var/lib/docker/).
If /var/lib/docker/231072.231072 satisfies your needs, then ignore the result of the test.
Its primary purpose is to make sure there's a partition so mad containers don't fill /.

[nithinka]

Hello @konstruktoid ,
I too have a similar issue
Here is my output

ubuntu@ip-10-10-1-244:~$ mountpoint -- /docker-data/
/docker-data/ is a mountpoint

ubuntu@ip-10-10-1-244:~$ docker info -f '{{ .DockerRootDir }}'
/docker-data

ubuntu@ip-10-10-1-244:~$ grep /docker-data /proc/mounts
/dev/xvdb1 /docker-data ext4 rw,relatime,data=ordered 0 0
overlay /docker-data/overlay2/98529b1145be2d655044aa6b239147def85fe3c17aa60917d7131c4dabb90653/merged overlay rw,relatime,lowerdir=/docker-data/overlay2/l/CEGZRXPOLDMTZDXTX5OPUZLMM6:/docker-data/overlay2/l/JCFTACQGX5R4MOIRZ35AEXRNLL:/docker-data/overlay2/l/W76VOKIMNPNV76FG6CXUVWSWGQ:/docker-data/overlay2/l/2Q5NPR6EKJPVBLMYYI4WA2HATZ:/docker-data/overlay2/l/KUPDNB5ZCZTIFESRTYTJNDYGR5:/docker-data/overlay2/l/RJKOJUWEQ5UGMJTYTVWNJGPYVQ:/docker-data/overlay2/l/JZT63IPNSIVWRB2ILUVDLDQKSY:/docker-data/overlay2/l/PWY6T34OPUEXZQLGZ4CLUDWMEF:/docker-data/overlay2/l/U64ZLYTYV2TQU7QTD5KR57UCYB:/docker-data/overlay2/l/N65G42CG2PLZHYLMTOBEOT2Z5F,upperdir=/docker-data/overlay2/98529b1145be2d655044aa6b239147def85fe3c17aa60917d7131c4dabb90653/diff,workdir=/docker-data/overlay2/98529b1145be2d655044aa6b239147def85fe3c17aa60917d7131c4dabb90653/work 0 0
shm /docker-data/containers/60cf1a783d0edbf4317396943f13a77939241c87f2414a718cb4dea7f3739e77/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0
overlay /docker-data/overlay2/d686f6276e55277879f0ccdecab38c60abbd5d9d8fc43e00cf62ab29ac73ea86/merged overlay rw,relatime,lowerdir=/docker-data/overlay2/l/RXBZRFLJWMT7ETSOGFT7SCPDTS:/docker-data/overlay2/l/HQVIEPFE2IZTRQMA6OH3F53SIE:/docker-data/overlay2/l/7BRPAKSD3RI2RECLW3EJCO7QNM:/docker-data/overlay2/l/N65G42CG2PLZHYLMTOBEOT2Z5F,upperdir=/docker-data/overlay2/d686f6276e55277879f0ccdecab38c60abbd5d9d8fc43e00cf62ab29ac73ea86/diff,workdir=/docker-data/overlay2/d686f6276e55277879f0ccdecab38c60abbd5d9d8fc43e00cf62ab29ac73ea86/work 0 0
shm /docker-data/containers/972cb2cac882ae6a0de2a0f64fda7f5dbca20c105128a06d9dfbabb5fe6d9c50/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0
overlay /docker-data/overlay2/603fe5bad2e462dc856a4bebb10b46bfaf224e2f2f488596909383479da1a94e/merged overlay rw,relatime,lowerdir=/docker-data/overlay2/l/YXRIBZSIOTXMTL6RNJDSPGYOXU:/docker-data/overlay2/l/ELFUXRCL47JN2IJQB2HC55QOZW:/docker-data/overlay2/l/XURYV6D57YSSSJFBH32EIWWL7X:/docker-data/overlay2/l/E3BYNF6GSOFLILDVMQNVFNDZBB:/docker-data/overlay2/l/OPXVSLE56KUOYN4PZEPUZYP22N:/docker-data/overlay2/l/PERULWJVAGFMQHIHI2HWLYD4RI:/docker-data/overlay2/l/KMLNHQL7L5776GJHPQEJC7NQAT:/docker-data/overlay2/l/H63WUUYTMSXMOSC5KMT7O4IJOH:/docker-data/overlay2/l/EBR2VVOXCDZGHIEA6ZD7KVUUA4:/docker-data/overlay2/l/N65G42CG2PLZHYLMTOBEOT2Z5F,upperdir=/docker-data/overlay2/603fe5bad2e462dc856a4bebb10b46bfaf224e2f2f488596909383479da1a94e/diff,workdir=/docker-data/overlay2/603fe5bad2e462dc856a4bebb10b46bfaf224e2f2f488596909383479da1a94e/work 0 0
shm /docker-data/containers/e7c03a8a305000043c911ea10171640f08f87f8ab40ad288b3ebd47beea5e0ee/mounts/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k 0 0

But the security bench tests does not seem to recognize this

[INFO] 1 - Host Configuration
[WARN] 1.1 - Ensure a separate partition for containers has been created
[NOTE] 1.2 - Ensure the container host has been Hardened

Any suggestions?

[konstruktoid]

Thanks @nithinka, I'll have a look.

[wlawton]

I have the same issue. I'm working with an AWS EC2 instance with an EBS volume mounted for the docker files. Originally I created sym-link in /var/lib/docker for /mnt/docker but I still got the warning for the 1.1 test. So then I copied the contents of /var/lib/docker into /mnt/docker, removed /var/lib/docker and added -g '/mnt/docker' to the docker startup options. Unfortunately still failing the 1.1 test. I know the actual aim has been achieved, but its the perfectionist in me wanting the visual clean-sweep of security tests.

df -h
/dev/xvda1 50G 1.3G 48G 3% /
/dev/xvdf 200G 2.0G 198G 1% /mnt/docker
overlay 200G 2.0G 198G 1% /mnt/docker/overlay2/2f0b11eb562a3eda14015caf6ee80fc602e62d9ecaf03dce1f7f90979268ca9b/merged
shm 64M 0 64M 0% /mnt/docker/containers/cf32038d98c38bef0a98f2e87c59a122c1ceb17ee140389328f8fe214a25e9a6/mounts/shm
overlay 200G 2.0G 198G 1% /mnt/docker/overlay2/45682bbb5ef37640772a4ab5e9e1b8060089f5922828ab19140d2aad0011d86b/merged
shm 64M 0 64M 0% /mnt/docker/containers/72cdcdfbcf13608468f67bbc48bc758401202785ba68d5ca07fe0e911e5a41b3/mounts/shm
overlay 200G 2.0G 198G 1% /mnt/docker/overlay2/14196914d933901bdcb50cd09244862cae878174f874c0e7b71ded5238aa14b8/merged
shm 64M 0 64M 0% /mnt/docker/containers/05456db1741b72c5acd497ee8186c2e3e08b0835b9009ff69741730d09e14b44/mounts/shm

mountpoint -- '/mnt/docker'
/mnt/docker is a mountpoint

docker info -f'{{.DockerRootDir }}'
/mnt/docker

[konstruktoid]

Hi @wlawton, I might be misunderstanding but does 1.1 fail even with the below results?

mountpoint -- '/mnt/docker'
/mnt/docker is a mountpoint

docker info -f'{{.DockerRootDir }}'
/mnt/docker

[wlawton]

Hi @konstruktoid.

Yes unfortunately it still outputs a warning. Here is the output of the two mount checks and the tests execution run in sequence:

`[root@ip-10-18-44-139 artifactory]# mountpoint -- '/mnt/docker'
/mnt/docker is a mountpoint
[root@ip-10-18-44-139 artifactory]# docker info -f'{{.DockerRootDir }}'
/mnt/docker
[root@ip-10-18-44-139 artifactory]# docker run -it --net host --pid host --userns host --cap-add audit_control -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST -v /etc:/etc:ro -v /usr/bin/docker-containerd:/usr/bin/docker-containerd:ro -v /usr/bin/docker-runc:/usr/bin/docker-runc:ro -v /usr/lib/systemd:/usr/lib/systemd:ro -v /var/lib:/var/lib:ro -v /var/run/docker.sock:/var/run/docker.sock:ro --label docker_bench_security docker/docker-bench-security
#------------------------------------------------------------------------------
#Docker Bench for Security v1.3.4

Docker, Inc. (c) 2015-

Checks for dozens of common best-practices around deploying Docker containers in production.

Inspired by the CIS Docker Community Edition Benchmark v1.1.0.

#------------------------------------------------------------------------------

Initializing Thu Jan 9 12:39:53 UTC 2020

[INFO] 1 - Host Configuration
[WARN] 1.1 - Ensure a separate partition for containers has been created
[NOTE] 1.2 - Ensure the container host has been Hardened
[INFO] 1.3 - Ensure Docker is up to date`

[konstruktoid]

Could you try running the bash script? The Docker image hasn't been updated yet (#405).

[wlawton]

Happy days! Warning is absent when using the bash script. Thanks a lot for your support.

Initializing Thu Jan 9 14:40:11 UTC 2020

[INFO] 1 - Host Configuration

[INFO] 1.1 - General Configuration
[NOTE] 1.1.1 - Ensure the container host has been Hardened
[INFO] 1.1.2 - Ensure Docker is up to date
[INFO] * Using 18.09.9, verify is it up to date as deemed necessary
[INFO] * Your operating system vendor may provide support and security maintenance for Docker
......etc

[konstruktoid]

Glad I could help :)

[konstruktoid]

Closing due to inactivity.