search

containers / podman-security-bench

Apache License 2.0
39 stars 10 forks source link

changed logic for retrieving mounts #5

Closed badamowicz closed 2 years ago

badamowicz commented 2 years ago

Seems podman inspect returns with an exit code of 0 even if it fails. That's why

if podman inspect --format '{{ .VolumesRW }}' "$c" 2>/dev/null 1>&2; then

succeeds, even if there is no VolumesRW field set. This in turn will execute

volumes=$(podman inspect --format '{{ .VolumesRW }}' "$c")

which overrides the previously populated variable $volumes which then may lead to a false positive result.

Couldn't find any good information about podman's exit codes which maybe would have led to another solution, so I'd like to propose this one.

All cases tested with podman version 3.4.2.

Cheers Bernd

Signed-off-by: Adamowicz, Bernd info@bernd-adamowicz.de

rhatdan commented 2 years ago

LGTM