Skip to content

Commit 88702cf

Browse files
authored
feat(misconf): Add support for deprecating a check (#6664)
Signed-off-by: Simar <[email protected]>
1 parent 1ad47c2 commit 88702cf

File tree

47 files changed

+358
-90
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+358
-90
lines changed

docs/docs/advanced/air-gap.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,8 @@ $ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12
129129

130130
No special measures are required to detect misconfigurations in an air-gapped environment.
131131

132-
### Run Trivy with `--skip-policy-update` option
133-
In an air-gapped environment, specify `--skip-policy-update` so that Trivy doesn't attempt to download the latest misconfiguration policies.
132+
### Run Trivy with `--skip-check-update` option
133+
In an air-gapped environment, specify `--skip-check-update` so that Trivy doesn't attempt to download the latest misconfiguration checks.
134134

135135
```
136136
$ trivy conf --skip-policy-update /path/to/conf

docs/docs/configuration/cache.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ The cache directory includes
33

44
- [Vulnerability Database][trivy-db][^1]
55
- [Java Index Database][trivy-java-db][^2]
6-
- [Misconfiguration Policies][misconf-policies][^3]
6+
- [Misconfiguration Checks][misconf-checks][^3]
77
- Cache of previous scans.
88

99
The cache option is common to all scanners.
@@ -70,7 +70,7 @@ $ trivy server --cache-backend redis://localhost:6379 \
7070

7171
[trivy-db]: ./db.md#vulnerability-database
7272
[trivy-java-db]: ./db.md#java-index-database
73-
[misconf-policies]: ../scanner/misconfiguration/check/builtin.md
73+
[misconf-checks]: ../scanner/misconfiguration/check/builtin.md
7474

7575
[^1]: Downloaded when scanning for vulnerabilities
7676
[^2]: Downloaded when scanning `jar/war/par/ear` files

docs/docs/configuration/filtering.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,7 @@ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7
483483
For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`.
484484
More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go).
485485
486-
You can find more example policies [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go)
486+
You can find more example checks [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go)
487487
488488
### By Vulnerability Exploitability Exchange (VEX)
489489
| Scanner | Supported |

docs/docs/coverage/iac/helm.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ The following scanners are supported.
1111
Trivy recursively searches directories and scans all found Helm files.
1212

1313
It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
14-
See [here](../../scanner/misconfiguration/check/builtin.md) for more details on the built-in policies.
14+
See [here](../../scanner/misconfiguration/check/builtin.md) for more details on the built-in checks.
1515

1616
### Value overrides
1717
There are a number of options for overriding values in Helm charts.

docs/docs/references/configuration/cli/trivy_aws.md

+1
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ trivy aws [flags]
8787
-h, --help help for aws
8888
--ignore-policy string specify the Rego file path to evaluate each vulnerability
8989
--ignorefile string specify .trivyignore file (default ".trivyignore")
90+
--include-deprecated-checks include deprecated checks
9091
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
9192
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
9293
--max-cache-age duration The maximum age of the cloud cache. Cached data will be required from the cloud provider if it is older than this. (default 24h0m0s)

docs/docs/references/configuration/cli/trivy_config.md

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ trivy config [flags] DIR
3131
-h, --help help for config
3232
--ignore-policy string specify the Rego file path to evaluate each vulnerability
3333
--ignorefile string specify .trivyignore file (default ".trivyignore")
34+
--include-deprecated-checks include deprecated checks
3435
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
3536
--k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0)
3637
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])

docs/docs/references/configuration/cli/trivy_filesystem.md

+1
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ trivy filesystem [flags] PATH
4949
--ignore-unfixed display only fixed vulnerabilities
5050
--ignored-licenses strings specify a list of license to ignore
5151
--ignorefile string specify .trivyignore file (default ".trivyignore")
52+
--include-deprecated-checks include deprecated checks
5253
--include-dev-deps include development dependencies in the report (supported: npm, yarn)
5354
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
5455
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")

docs/docs/references/configuration/cli/trivy_image.md

+1
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ trivy image [flags] IMAGE_NAME
6767
--ignorefile string specify .trivyignore file (default ".trivyignore")
6868
--image-config-scanners strings comma-separated list of what security issues to detect on container image configurations (misconfig,secret)
6969
--image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote])
70+
--include-deprecated-checks include deprecated checks
7071
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
7172
--input string input file path instead of image name
7273
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")

docs/docs/references/configuration/cli/trivy_kubernetes.md

+1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ trivy kubernetes [flags] [CONTEXT]
6262
--ignore-unfixed display only fixed vulnerabilities
6363
--ignorefile string specify .trivyignore file (default ".trivyignore")
6464
--image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote])
65+
--include-deprecated-checks include deprecated checks
6566
--include-kinds strings indicate the kinds included in scanning (example: node)
6667
--include-namespaces strings indicate the namespaces included in scanning (example: kube-system)
6768
--include-non-failures include successes and exceptions, available with '--scanners misconfig'

docs/docs/references/configuration/cli/trivy_repository.md

+1
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
4949
--ignore-unfixed display only fixed vulnerabilities
5050
--ignored-licenses strings specify a list of license to ignore
5151
--ignorefile string specify .trivyignore file (default ".trivyignore")
52+
--include-deprecated-checks include deprecated checks
5253
--include-dev-deps include development dependencies in the report (supported: npm, yarn)
5354
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
5455
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")

docs/docs/references/configuration/cli/trivy_rootfs.md

+1
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ trivy rootfs [flags] ROOTDIR
5252
--ignore-unfixed display only fixed vulnerabilities
5353
--ignored-licenses strings specify a list of license to ignore
5454
--ignorefile string specify .trivyignore file (default ".trivyignore")
55+
--include-deprecated-checks include deprecated checks
5556
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
5657
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
5758
--license-confidence-level float specify license classifier's confidence level (default 0.9)

docs/docs/references/configuration/config-file.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -382,10 +382,14 @@ misconfiguration:
382382
# Same as '--include-non-failures'
383383
# Default is false
384384
include-non-failures: false
385+
386+
# Same as '--include-deprecated-checks'
387+
# Default is false
388+
include-deprecated-checks: false
385389

386-
# Same as '--policy-bundle-repository'
390+
# Same as '--check-bundle-repository' and '--policy-bundle-repository'
387391
# Default is 'ghcr.io/aquasecurity/trivy-checks:0'
388-
policy-bundle-repository: ghcr.io/aquasecurity/trivy-checks:0
392+
check-bundle-repository: ghcr.io/aquasecurity/trivy-checks:0
389393

390394
# Same as '--miconfig-scanners'
391395
# Default is all scanners

docs/docs/scanner/misconfiguration/check/exceptions.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ Exceptions let you specify cases where you allow policy violations.
33
Trivy supports two types of exceptions.
44

55
!!! info
6-
Exceptions can be applied to built-in policies as well as custom policies.
6+
Exceptions can be applied to built-in checks as well as custom checks.
77

88
## Namespace-based exceptions
9-
There are some cases where you need to disable built-in policies partially or fully.
9+
There are some cases where you need to disable built-in checks partially or fully.
1010
Namespace-based exceptions lets you rough choose which individual packages to exempt.
1111

1212
To use namespace-based exceptions, create a Rego rule with the name `exception` that returns the package names to exempt.
@@ -26,7 +26,7 @@ The `exception` rule must be defined under `namespace.exceptions`.
2626
}
2727
```
2828

29-
This example exempts all built-in policies for Kubernetes.
29+
This example exempts all built-in checks for Kubernetes.
3030

3131
## Rule-based exceptions
3232
There are some cases where you need more flexibility and granularity in defining which cases to exempt.
@@ -73,7 +73,7 @@ The above would provide an exception from `deny_foo` and `deny_bar`.
7373
}
7474
```
7575

76-
If you want to apply rule-based exceptions to built-in policies, you have to define the exception under the same package.
76+
If you want to apply rule-based exceptions to built-in checks, you have to define the exception under the same package.
7777

7878
!!! example
7979
``` rego

docs/docs/scanner/misconfiguration/custom/data.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Custom Data
22

3-
Custom policies may require additional data in order to determine an answer.
3+
Custom checks may require additional data in order to determine an answer.
44

55
For example, an allowed list of resources that can be created.
66
Instead of hardcoding this information inside your policy, Trivy allows passing paths to data files with the `--data` flag.

docs/docs/scanner/misconfiguration/custom/debug.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
# Debugging policies
1+
# Debugging checks
22
When working on more complex queries (or when learning Rego), it's useful to see exactly how the policy is applied.
33
For this purpose you can use the `--trace` flag.
44
This will output a large trace from Open Policy Agent like the following:
55

66
!!! tip
7-
Only failed policies show traces. If you want to debug a passed policy, you need to make it fail on purpose.
7+
Only failed checks show traces. If you want to debug a passed check, you need to make it fail on purpose.
88

99
```shell
1010
$ trivy conf --trace configs/

docs/docs/scanner/misconfiguration/custom/index.md

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
# Custom Policies
1+
# Custom Checks
22

33
## Overview
4-
You can write custom policies in [Rego][rego].
5-
Once you finish writing custom policies, you can pass the policy files or the directory where those policies are stored with `--policy` option.
4+
You can write custom checks in [Rego][rego].
5+
Once you finish writing custom checks, you can pass the policy files or the directory where those policies are stored with `--policy` option.
66

77
``` bash
88
trivy conf --policy /path/to/policy.rego --policy /path/to/custom_policies --namespaces user /path/to/config_dir
@@ -120,7 +120,7 @@ Trivy supports extra fields in the `custom` section as described below.
120120
```
121121

122122
All fields are optional. The `schemas` field should be used to enable policy validation using a built-in schema. The
123-
schema that will be used is based on the input document type. It is recommended to use this to ensure your policies are
123+
schema that will be used is based on the input document type. It is recommended to use this to ensure your checks are
124124
correct and do not reference incorrect properties/values.
125125

126126
| Field name | Allowed values | Default value | In table | In JSON |
@@ -131,6 +131,7 @@ correct and do not reference incorrect properties/values.
131131
| custom.id | Any characters | N/A | :material-check: | :material-check: |
132132
| custom.severity | `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` | UNKNOWN | :material-check: | :material-check: |
133133
| custom.recommended_actions | Any characters | | :material-close: | :material-check: |
134+
| custom.deprecated | `true`, `false` | `false` | :material-close: | :material-check: |
134135
| custom.input.selector.type | Any item(s) in [this list][source-types] | | :material-close: | :material-check: |
135136
| url | Any characters | | :material-close: | :material-check: |
136137

docs/docs/scanner/misconfiguration/custom/schema.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ Currently, out of the box the following schemas are supported natively:
5454
3. [Cloud](https://github.com/aquasecurity/trivy/blob/main/pkg/iac/rego/schemas/cloud.json)
5555

5656

57-
## Custom Policies with Custom Schemas
57+
## Custom Checks with Custom Schemas
5858

5959
You can also bring a custom policy that defines one or more custom schema.
6060

@@ -71,21 +71,21 @@ You can also bring a custom policy that defines one or more custom schema.
7171
}
7272
```
7373

74-
The policies can be placed in a structure as follows
74+
The checks can be placed in a structure as follows
7575

7676
!!! example
7777
```
78-
/Users/user/my-custom-policies
78+
/Users/user/my-custom-checks
7979
├── my_policy.rego
8080
└── schemas
8181
└── fooschema.json
8282
└── barschema.json
8383
```
8484

85-
To use such a policy with Trivy, use the `--config-policy` flag that points to the policy file or to the directory where the schemas and policies are contained.
85+
To use such a policy with Trivy, use the `--config-policy` flag that points to the policy file or to the directory where the schemas and checks are contained.
8686

8787
```bash
88-
$ trivy --config-policy=/Users/user/my-custom-policies <path/to/iac>
88+
$ trivy --config-policy=/Users/user/my-custom-checks <path/to/iac>
8989
```
9090

91-
For more details on how to define schemas within Rego policies, please see the [OPA guide](https://www.openpolicyagent.org/docs/latest/policy-language/#schema-annotations) that describes it in more detail.
91+
For more details on how to define schemas within Rego checks, please see the [OPA guide](https://www.openpolicyagent.org/docs/latest/policy-language/#schema-annotations) that describes it in more detail.

docs/docs/scanner/misconfiguration/custom/testing.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# Testing
2-
It is highly recommended to write tests for your custom policies.
2+
It is highly recommended to write tests for your custom checks.
33

44
## Rego testing
5-
To help you verify the correctness of your custom policies, OPA gives you a framework that you can use to write tests for your policies.
6-
By writing tests for your custom policies you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve.
5+
To help you verify the correctness of your custom checks, OPA gives you a framework that you can use to write tests for your checks.
6+
By writing tests for your custom checks you can speed up the development process of new rules and reduce the amount of time it takes to modify rules as requirements evolve.
77

88
For more details, see [Policy Testing][opa-testing].
99

@@ -22,12 +22,12 @@ For more details, see [Policy Testing][opa-testing].
2222
}
2323
```
2424

25-
To write tests for custom policies, you can refer to existing tests under [trivy-checks][trivy-checks].
25+
To write tests for custom checks, you can refer to existing tests under [trivy-checks][trivy-checks].
2626

2727
## Go testing
2828
[Fanal][fanal] which is a core library of Trivy can be imported as a Go library.
29-
You can scan config files in Go and test your custom policies using Go's testing methods, such as [table-driven tests][table].
30-
This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom policies work in practice.
29+
You can scan config files in Go and test your custom checks using Go's testing methods, such as [table-driven tests][table].
30+
This allows you to use the actual configuration file as input, making it easy to prepare test data and ensure that your custom checks work in practice.
3131

3232
In particular, Dockerfile and HCL need to be converted to structural data as input, which may be different from the expected input format.
3333

docs/docs/scanner/misconfiguration/index.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Misconfiguration Scanning
2-
Trivy provides built-in policies to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more.
3-
In addition to built-in policies, you can write your own custom policies, as you can see [here][custom].
2+
Trivy provides built-in checks to detect configuration issues in popular Infrastructure as Code files, such as: Docker, Kubernetes, Terraform, CloudFormation, and more.
3+
In addition to built-in checks, you can write your own custom checks, as you can see [here][custom].
44

55
## Quick start
66

@@ -94,7 +94,7 @@ In the above example, Trivy detected vulnerabilities of Python dependencies and
9494

9595
## Type detection
9696
The specified directory can contain mixed types of IaC files.
97-
Trivy automatically detects config types and applies relevant policies.
97+
Trivy automatically detects config types and applies relevant checks.
9898

9999
For example, the following example holds IaC files for Terraform, CloudFormation, Kubernetes, Helm Charts, and Dockerfile in the same directory.
100100

@@ -326,16 +326,16 @@ trivy config --misconfig-scanners=terraform,dockerfile .
326326

327327
Will only scan for misconfigurations that pertain to Terraform and Dockerfiles.
328328

329-
### Passing custom policies
330-
You can pass policy files or directories including your custom policies through `--policy` option.
329+
### Passing custom checks
330+
You can pass policy files or directories including your custom checks through `--policy` option.
331331
This can be repeated for specifying multiple files or directories.
332332

333333
```bash
334334
cd examplex/misconf/
335335
trivy conf --policy custom-policy/policy --policy combine/policy --policy policy.rego --namespaces user misconf/mixed
336336
```
337337

338-
For more details, see [Custom Policies](./custom/index.md).
338+
For more details, see [Custom Checks](./custom/index.md).
339339

340340
!!! tip
341341
You also need to specify `--namespaces` option.
@@ -352,8 +352,8 @@ trivy conf --policy ./policy --data ./data --namespaces user ./configs
352352
For more details, see [Custom Data](./custom/data.md).
353353

354354
### Passing namespaces
355-
By default, Trivy evaluates policies defined in `builtin.*`.
356-
If you want to evaluate custom policies in other packages, you have to specify package prefixes through `--namespaces` option.
355+
By default, Trivy evaluates checks defined in `builtin.*`.
356+
If you want to evaluate custom checks in other packages, you have to specify package prefixes through `--namespaces` option.
357357
This can be repeated for specifying multiple packages.
358358

359359
``` bash

0 commit comments

Comments
 (0)