False positives for 2.5 (ensure no insecure registries)

[pgatilov]

Hello,

We've encountered an issue where check '2.5 - Ensure insecure registries are not used' sometimes gives false positives on default docker installation:

• OS: RedHat
• docker-security-bench version: 1.5 (~ mid June 2023)
• Check 2.5 result: WARN
• Output of "docker info --format 'Insecure Registries: {{.RegistryConfig.InsecureRegistryCIDRs}}'":
  • Insecure Registries: [127.0.0.0/8]
• daemon.json contents:

{
        "icc": false,
        "storage-driver": "overlay2",
        "default-ulimit": true,
        "userns-remap": "default",
        "live-restore": true,
        "userland-proxy": false,
        "no-new-privileges": true,
        "log-level": "info"
}

Seems like in some cases the tool triggers on localhost record which docker adds by default:

Local registries, whose IP address falls in the 127.0.0.0/8 range, are automatically marked as insecure as of Docker 1.3.2. It is not recommended to rely on this, as it may change in the future. See here

Should there be some exception for this default record? Or a way to specify a list of allowed insecure registries to the tool, so it's not necessary to review the configuration every time benchmark is run?

Thanks

PS

We don't run / intend to run any registry on localhost, nor have we configured anything for that. At least not intentionally.

[konstruktoid]

Hi @pgatilov, I believe the correct way to handle it is to add an empty array to the configuration file and manage that setting as any other.

[pgatilov]

Hi @konstruktoid , thanks for your response. Well, adding "insecure-registries": [] did help, thanks!

However, it's a bit confusing because the output of docker info still shows 127.0.0.0/8. Seems like the tool uses a different way of checking the setting compared to what is described in the Docker Benchmark PDF

[konstruktoid]

That's great to hear.

The script has evolved from the PDF due to the variations people have compared to the benchmark; swarm and services and whatnot.

Does the insecure registry still show up after a docker daemon restart?

[pgatilov]

@konstruktoid , yes, it still shows up. I believe it's some built-in logic for docker.

[konstruktoid]

Sorry to say, that's nothing this script can fix