Skip to content

Commit 1c9ccb5

Browse files
knqyf263knqyf263
authored
feat(command): add rootfs command (#1271)
1 parent a463e79 commit 1c9ccb5

File tree

21 files changed

+270
-133
lines changed

21 files changed

+270
-133
lines changed

‎docs/advanced/container/embed-in-dockerfile.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ FROM alpine:3.7
1010

1111
RUN apk add curl \
1212
&& curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin \
13-
&& trivy filesystem --exit-code 1 --no-progress /
13+
&& trivy rootfs --exit-code 1 --no-progress /
1414

1515
$ docker build -t vulnerable-image .
1616
```
@@ -21,7 +21,7 @@ insecure `curl | sh`. Also the image is not changed.
2121
# Run vulnerability scan on build image
2222
FROM build AS vulnscan
2323
COPY --from=aquasec/trivy:latest /usr/local/bin/trivy /usr/local/bin/trivy
24-
RUN trivy filesystem --exit-code 1 --no-progress /
24+
RUN trivy rootfs --exit-code 1 --no-progress /
2525
[...]
2626
```
2727

‎docs/advanced/container/unpacked-filesystem.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ In this case, Trivy works the same way when scanning containers
66

77
```bash
88
$ docker export $(docker create alpine:3.10.2) | tar -C /tmp/rootfs -xvf -
9-
$ trivy fs /tmp/rootfs
9+
$ trivy rootfs /tmp/rootfs
1010
```
1111

1212
<details>

‎docs/getting-started/cli/fs.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,13 @@ USAGE:
1010
OPTIONS:
1111
--template value, -t value output template [$TRIVY_TEMPLATE]
1212
--format value, -f value format (table, json, template) (default: "table") [$TRIVY_FORMAT]
13-
--input value, -i value input file path instead of image name [$TRIVY_INPUT]
1413
--severity value, -s value severities of vulnerabilities to be displayed (comma separated) (default: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL") [$TRIVY_SEVERITY]
1514
--output value, -o value output file name [$TRIVY_OUTPUT]
1615
--exit-code value Exit code when vulnerabilities were found (default: 0) [$TRIVY_EXIT_CODE]
1716
--skip-db-update, --skip-update skip updating vulnerability database (default: false) [$TRIVY_SKIP_UPDATE, $TRIVY_SKIP_DB_UPDATE]
1817
--skip-policy-update skip updating built-in policies (default: false) [$TRIVY_SKIP_POLICY_UPDATE]
1918
--clear-cache, -c clear image caches without scanning (default: false) [$TRIVY_CLEAR_CACHE]
2019
--ignore-unfixed display only fixed vulnerabilities (default: false) [$TRIVY_IGNORE_UNFIXED]
21-
--removed-pkgs detect vulnerabilities of removed packages (only for Alpine) (default: false) [$TRIVY_REMOVED_PKGS]
2220
--vuln-type value comma-separated list of vulnerability types (os,library) (default: "os,library") [$TRIVY_VULN_TYPE]
2321
--security-checks value comma-separated list of what security issues to detect (vuln,config) (default: "vuln") [$TRIVY_SECURITY_CHECKS]
2422
--ignorefile value specify .trivyignore file (default: ".trivyignore") [$TRIVY_IGNOREFILE]

‎docs/getting-started/cli/rootfs.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Rootfs
2+
3+
```bash
4+
NAME:
5+
trivy rootfs - scan rootfs
6+
7+
USAGE:
8+
trivy rootfs [command options] dir
9+
10+
OPTIONS:
11+
--template value, -t value output template [$TRIVY_TEMPLATE]
12+
--format value, -f value format (table, json, template) (default: "table") [$TRIVY_FORMAT]
13+
--severity value, -s value severities of vulnerabilities to be displayed (comma separated) (default: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL") [$TRIVY_SEVERITY]
14+
--output value, -o value output file name [$TRIVY_OUTPUT]
15+
--exit-code value Exit code when vulnerabilities were found (default: 0) [$TRIVY_EXIT_CODE]
16+
--skip-db-update, --skip-update skip updating vulnerability database (default: false) [$TRIVY_SKIP_UPDATE, $TRIVY_SKIP_DB_UPDATE]
17+
--skip-policy-update skip updating built-in policies (default: false) [$TRIVY_SKIP_POLICY_UPDATE]
18+
--clear-cache, -c clear image caches without scanning (default: false) [$TRIVY_CLEAR_CACHE]
19+
--ignore-unfixed display only fixed vulnerabilities (default: false) [$TRIVY_IGNORE_UNFIXED]
20+
--vuln-type value comma-separated list of vulnerability types (os,library) (default: "os,library") [$TRIVY_VULN_TYPE]
21+
--security-checks value comma-separated list of what security issues to detect (vuln,config) (default: "vuln") [$TRIVY_SECURITY_CHECKS]
22+
--ignorefile value specify .trivyignore file (default: ".trivyignore") [$TRIVY_IGNOREFILE]
23+
--cache-backend value cache backend (e.g. redis://localhost:6379) (default: "fs") [$TRIVY_CACHE_BACKEND]
24+
--timeout value timeout (default: 5m0s) [$TRIVY_TIMEOUT]
25+
--no-progress suppress progress bar (default: false) [$TRIVY_NO_PROGRESS]
26+
--ignore-policy value specify the Rego file to evaluate each vulnerability [$TRIVY_IGNORE_POLICY]
27+
--list-all-pkgs enabling the option will output all packages regardless of vulnerability (default: false) [$TRIVY_LIST_ALL_PKGS]
28+
--skip-files value specify the file paths to skip traversal [$TRIVY_SKIP_FILES]
29+
--skip-dirs value specify the directories where the traversal is skipped [$TRIVY_SKIP_DIRS]
30+
--config-policy value specify paths to the Rego policy files directory, applying config files [$TRIVY_CONFIG_POLICY]
31+
--config-data value specify paths from which data for the Rego policies will be recursively loaded [$TRIVY_CONFIG_DATA]
32+
--policy-namespaces value, --namespaces value Rego namespaces (default: "users") [$TRIVY_POLICY_NAMESPACES]
33+
--help, -h show help (default: false)
34+
```

‎docs/getting-started/overview.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Trivy detects two types of security issues:
88
Trivy can scan three different artifacts:
99

1010
- [Container Images][container]
11-
- [Filesystem][filesystem]
11+
- [Filesystem][filesystem] and [Rootfs][rootfs]
1212
- [Git Repositories][repo]
1313

1414
Trivy can be run in two different modes:
@@ -53,7 +53,7 @@ See [Integrations][integrations] for details.
5353
- A remote image in Docker Registry such as Docker Hub, ECR, GCR and ACR
5454
- A tar archive stored in the `docker save` / `podman save` formatted file
5555
- An image directory compliant with [OCI Image Format][oci]
56-
- local filesystem
56+
- local filesystem and rootfs
5757
- remote git repository
5858

5959
Please see [LICENSE][license] for Trivy licensing information.
@@ -64,6 +64,7 @@ Please see [LICENSE][license] for Trivy licensing information.
6464
[vuln]: ../vulnerability/scanning/index.md
6565
[misconf]: ../misconfiguration/index.md
6666
[container]: ../vulnerability/scanning/image.md
67+
[rootfs]: ../vulnerability/scanning/rootfs.md
6768
[filesystem]: ../vulnerability/scanning/filesystem.md
6869
[repo]: ../vulnerability/scanning/git-repository.md
6970

‎docs/vulnerability/detection/language.md

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,23 @@
22

33
`Trivy` automatically detects the following files in the container and scans vulnerabilities in the application dependencies.
44

5-
| Language | File | Image[^6] | Filesystem[^7] | Repository[^8] |Dev dependencies |
6-
|---------|-------------------------|:---------:|:--------------:|:---------------:|-----------------|
7-
| Ruby | Gemfile.lock | - | ✅ | ✅ | included |
8-
| | gemspec | ✅ | ✅ | - | included |
9-
| Python | Pipfile.lock | - | ✅ | ✅ | excluded |
10-
| | poetry.lock | - | ✅ | ✅ | included |
11-
| | requirements.txt | - | ✅ | ✅ | included |
12-
| | egg package[^1] | ✅ | ✅ | - | excluded |
13-
| | wheel package[^2] | ✅ | ✅ | - | excluded |
14-
| PHP | composer.lock | ✅ | ✅ | ✅ | excluded |
15-
| Node.js | package-lock.json | - | ✅ | ✅ | excluded |
16-
| | yarn.lock | - | ✅ | ✅ | included |
17-
| | package.json | ✅ | ✅ | - | excluded |
18-
| .NET | packages.lock.json | ✅ | ✅ | ✅ | included |
19-
| Java | JAR/WAR/EAR[^3][^4] | ✅ | ✅ | ✅ | included |
20-
| Go | Binaries built by Go[^5] | ✅ | ✅ | - | excluded |
21-
| | go.sum | - | ✅ | ✅ | included |
5+
| Language | File | Image[^6] | Rootfs[^7] | Filesysetm[^8] | Repository[^9] |Dev dependencies |
6+
|----------|--------------------------|:---------:|:----------:|:--------------:|:---------------:|-----------------|
7+
| Ruby | Gemfile.lock | - | - | ✅ | ✅ | included |
8+
| | gemspec | ✅ | ✅ | - | - | included |
9+
| Python | Pipfile.lock | - | - | ✅ | ✅ | excluded |
10+
| | poetry.lock | - | - | ✅ | ✅ | included |
11+
| | requirements.txt | - | - | ✅ | ✅ | included |
12+
| | egg package[^1] | ✅ | ✅ | - | - | excluded |
13+
| | wheel package[^2] | ✅ | ✅ | - | - | excluded |
14+
| PHP | composer.lock | ✅ | ✅ | ✅ | ✅ | excluded |
15+
| Node.js | package-lock.json | - | - | ✅ | ✅ | excluded |
16+
| | yarn.lock | - | - | ✅ | ✅ | included |
17+
| | package.json | ✅ | ✅ | - | - | excluded |
18+
| .NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ | included |
19+
| Java | JAR/WAR/EAR[^3][^4] | ✅ | ✅ | ✅ | ✅ | included |
20+
| Go | Binaries built by Go[^5] | ✅ | ✅ | - | - | excluded |
21+
| | go.sum | - | - | ✅ | ✅ | included |
2222

2323
The path of these files does not matter.
2424

@@ -30,5 +30,6 @@ Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Do
3030
[^4]: It requires the Internet access
3131
[^5]: UPX-compressed binaries don't work
3232
[^6]: ✅ means "enabled" and `-` means "disabled" in the image scanning
33-
[^7]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning
34-
[^8]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning
33+
[^7]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning
34+
[^8]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning
35+
[^9]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning

‎docs/vulnerability/scanning/filesystem.md

Lines changed: 1 addition & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Filesystem
22

3-
Scan a filesystem (such as a host machine, a virtual machine image, or an unpacked container image filesystem).
3+
Scan a local project including language-specific files.
44

55
```bash
66
$ trivy fs /path/to/project
@@ -47,57 +47,3 @@ Total: 10 (UNKNOWN: 2, LOW: 0, MEDIUM: 6, HIGH: 2, CRITICAL: 0)
4747
```
4848

4949
</details>
50-
51-
## From Inside Containers
52-
Scan your container from inside the container.
53-
54-
```bash
55-
$ docker run --rm -it alpine:3.11
56-
/ # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
57-
/ # trivy fs /
58-
```
59-
60-
<details>
61-
<summary>Result</summary>
62-
63-
```
64-
2021-03-08T05:22:26.378Z INFO Need to update DB
65-
2021-03-08T05:22:26.380Z INFO Downloading DB...
66-
20.37 MiB / 20.37 MiB [-------------------------------------------------------------------------------------------------------------------------------------] 100.00% 8.24 MiB p/s 2s
67-
2021-03-08T05:22:30.134Z INFO Detecting Alpine vulnerabilities...
68-
2021-03-08T05:22:30.138Z INFO Trivy skips scanning programming language libraries because no supported file was detected
69-
70-
313430f09696 (alpine 3.11.7)
71-
============================
72-
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 6, CRITICAL: 0)
73-
74-
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
75-
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
76-
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
77-
| libcrypto1.1 | CVE-2021-23839 | HIGH | 1.1.1i-r0 | 1.1.1j-r0 | openssl: incorrect SSLv2 |
78-
| | | | | | rollback protection |
79-
| | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 |
80-
+ +------------------+ + + +---------------------------------------+
81-
| | CVE-2021-23840 | | | | openssl: integer |
82-
| | | | | | overflow in CipherUpdate |
83-
| | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 |
84-
+ +------------------+ + + +---------------------------------------+
85-
| | CVE-2021-23841 | | | | openssl: NULL pointer dereference |
86-
| | | | | | in X509_issuer_and_serial_hash() |
87-
| | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 |
88-
+--------------+------------------+ + + +---------------------------------------+
89-
| libssl1.1 | CVE-2021-23839 | | | | openssl: incorrect SSLv2 |
90-
| | | | | | rollback protection |
91-
| | | | | | -->avd.aquasec.com/nvd/cve-2021-23839 |
92-
+ +------------------+ + + +---------------------------------------+
93-
| | CVE-2021-23840 | | | | openssl: integer |
94-
| | | | | | overflow in CipherUpdate |
95-
| | | | | | -->avd.aquasec.com/nvd/cve-2021-23840 |
96-
+ +------------------+ + + +---------------------------------------+
97-
| | CVE-2021-23841 | | | | openssl: NULL pointer dereference |
98-
| | | | | | in X509_issuer_and_serial_hash() |
99-
| | | | | | -->avd.aquasec.com/nvd/cve-2021-23841 |
100-
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
101-
```
102-
103-
</details>

‎docs/vulnerability/scanning/index.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
# Vulnerability Scanning
22

3-
Trivy scans [Container Images][image], [Filesystem][fs], and [Git Repositories][repo] to detect vulnerabilities.
3+
Trivy scans [Container Images][image], [Rootfs][rootfs], [Filesystem][fs], and [Git Repositories][repo] to detect vulnerabilities.
44

55
![vulnerability][vuln]
66

77
[image]: image.md
8+
[rootfs]: rootfs.md
89
[fs]: filesystem.md
910
[repo]: git-repository.md
1011
[vuln]: ../../imgs/vulnerability.png

0 commit comments

Comments
 (0)