stale[bot]
commented
10 months ago Thanks for contributing to Checkov! We've automatically marked this issue as stale to keep our issues list tidy, because it has not had any activity for 6 months. It will be closed in 14 days if no further activity occurs. Commenting on this issue will remove the stale tag. If you want to talk through the issue or help us understand the priority and context, feel free to add a comment or join us in the Checkov slack channel at codifiedsecurity.slack.com Thanks!
izeau
Describe the issue
According to the documentation,
--skip-pathrefers to the “Path (file or directory) to skip, using regular expression logic, relative to the current working directory” (emphasis mine). That is indeed the case when using some runners (e.g.dockerfile), but not for others. For instance, theterraformrunner uses an absolute path due to the root directory being set usingos.path.abspath().Examples
setup
```bash $ cd $(mktemp -d) $ mkdir -p foo subdir $ echo 'FROM foo' > subdir/Dockerfile $ echo 'resource "aws_instance" "foo" {}' > subdir/main.tf $ cp -r subdir foo $ tree . ├── foo │ └── subdir │ ├── Dockerfile │ └── main.tf └── subdir ├── Dockerfile └── main.tf 4 directories, 4 files $ alias ckv="checkov --check CKV_AWS_79,CKV_DOCKER_2 --skip-download --quiet --compact --directory ." $ ckv terraform scan results: Passed checks: 0, Failed checks: 2, Skipped checks: 0 Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled" FAILED for resource: aws_instance.foo File: /foo/subdir/main.tf:1-1 Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled" FAILED for resource: aws_instance.foo File: /subdir/main.tf:1-1 dockerfile scan results: Passed checks: 0, Failed checks: 2, Skipped checks: 0 Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" FAILED for resource: /subdir/Dockerfile. File: /subdir/Dockerfile:1-1 Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" FAILED for resource: /foo/subdir/Dockerfile. File: /foo/subdir/Dockerfile:1-1 ```
```bash $ ckv --skip-path subdir ```--skip-path subdirskips everything
```bash $ ckv --skip-path "^./subdir" terraform scan results: Passed checks: 0, Failed checks: 2, Skipped checks: 0 Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled" FAILED for resource: aws_instance.foo File: /foo/subdir/main.tf:1-1 Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled" FAILED for resource: aws_instance.foo File: /subdir/main.tf:1-1 dockerfile scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" FAILED for resource: /foo/subdir/Dockerfile. File: /foo/subdir/Dockerfile:1-1 ```--skip-path "^./subdir"leaves duplicate terraform checks
```bash $ ckv --skip-path "${PWD}/subdir" terraform scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled" FAILED for resource: aws_instance.foo File: /foo/subdir/main.tf:1-1 dockerfile scan results: Passed checks: 0, Failed checks: 2, Skipped checks: 0 Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" FAILED for resource: /foo/subdir/Dockerfile. File: /foo/subdir/Dockerfile:1-1 Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" FAILED for resource: /subdir/Dockerfile. File: /subdir/Dockerfile:1-1 ```--skip-path "${PWD}/subdir"leaves duplicate dockerfile checksgetting proper results using both
```bash ckv --skip-path "^./subdir" --skip-path "${PWD}/subdir" terraform scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKV_AWS_79: "Ensure Instance Metadata Service Version 1 is not enabled" FAILED for resource: aws_instance.foo File: /foo/subdir/main.tf:1-1 dockerfile scan results: Passed checks: 0, Failed checks: 1, Skipped checks: 0 Check: CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images" FAILED for resource: /foo/subdir/Dockerfile. File: /foo/subdir/Dockerfile:1-1 ```--skip-pathargumentsTL;DR:
--skip-path subdirskips./foo/subdirand./subdir.--skip-path "^subdir"skips the dockerfile checks in./subdir, but runs the terraform ones, leading to duplicates.--skip-path "${PWD}/subdir"skips the terraform checks in./subdir, but runs the dockerfile ones, leading to duplicates.Desktop (please complete the following information):