chaitin / veinmind-tools

veinmind-tools 是由长亭科技自研,基于 veinmind-sdk 打造的容器安全工具集
https://veinmind.chaitin.com/docs/
MIT License
1.51k stars 179 forks source link

veinmind-unsafe-mount 无法扫描全部容器 #276

Open reloc2 opened 2 months ago

reloc2 commented 2 months ago

Bug 具体描述 └─# ./veinmind-unsafe-mount scan container INFO[0000] start scan container unsafe mount: 00b4f49c139b2798ab8af43e9cc45ebd7407ef030be4fa54f806d6d7e247b923 Error: container: container not running, can't get oci spec Usage: scan container [flags]

Flags: --containerd[=true] specify "containerd" as the mode in use --containerd-config string flag "--config" or "-c" specified to containerd command --containerd-root string flag "--root" specified to the containerd command --containerd-unique-desc string unique descriptor of the containerd daemon --docker[=true] specify "docker" as the mode in use --docker-config-file string flag "--config-file" specified to the dockerd command --docker-data-root string flag "--data-root" specified to the dockerd command --docker-unique-desc string unique descriptor of the docker daemon -f, --format , cli/json/html, support multiple with , split (default "cli") -h, --help help for container --host stringArray the URL of host communication file --id whether fully qualified ID is specified --in-cluster string flag "--in-cluster" specified in-cluster --kube-config-bytes string flag "--kube-config-bytes" specified kube config bytes --kube-config-path string flag "--kube-config-path" specified kube config --kubernetes[=true] specify "kubernetes" as the mode in use -m, --mode string select mode to retrieve root object (default "docker") --remote[=true] specify "remote" as the mode in use --remote-root string remote manager system data root --tarball[=true] specify "tarball" as the mode in use --tarball-root string tarball manager system data root -v, --verbose show detail info at cli

复现步骤

相关截图

环境(空项可以不填)

补充说明 └─# cat /proc/version Linux version 6.1.0-kali9-amd64 (devel@kali.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.27-1kali1 (2023-05-12)

DVKunion commented 2 months ago

存在非运行状态的容器,这类容器无法扫描,会导致出现异常。

reloc2 commented 2 months ago

如果存在非运行状态的容器,这种跳过会有影响么

DVKunion commented 2 months ago

目前没写查询容器状态的接口,后续可以考虑暴露一下容器状态的口子供插件使用,如果遇到非运行状态的容器则跳过。