Skip to content

Commit c70b6fa

Browse files
simar7simar7
authored
refactor(misconf): Deprecate EXCEPTIONS for misconfiguration scanning (#7776)
Signed-off-by: Simar <[email protected]>
1 parent c434775 commit c70b6fa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+430
-865
lines changed

‎contrib/junit.tpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
</testsuite>
1717

1818
{{- if .MisconfSummary }}
19-
<testsuite tests="{{ add .MisconfSummary.Successes .MisconfSummary.Failures }}" failures="{{ .MisconfSummary.Failures }}" name="{{ .Target }}" errors="0" skipped="{{ .MisconfSummary.Exceptions }}" time="">
19+
<testsuite tests="{{ add .MisconfSummary.Successes .MisconfSummary.Failures }}" failures="{{ .MisconfSummary.Failures }}" name="{{ .Target }}" errors="0" time="">
2020
{{- else }}
2121
<testsuite tests="0" failures="0" name="{{ .Target }}" errors="0" skipped="0" time="">
2222
{{- end }}

‎docs/docs/configuration/filtering.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ trivy config --severity HIGH,CRITICAL examples/misconf/mixed
112112

113113
Dockerfile (dockerfile)
114114
=======================
115-
Tests: 17 (SUCCESSES: 16, FAILURES: 1, EXCEPTIONS: 0)
115+
Tests: 17 (SUCCESSES: 16, FAILURES: 1)
116116
Failures: 1 (HIGH: 1, CRITICAL: 0)
117117

118118
HIGH: Last USER command in Dockerfile should not be 'root'
@@ -130,13 +130,13 @@ See https://avd.aquasec.com/misconfig/ds002
130130

131131
deployment.yaml (kubernetes)
132132
============================
133-
Tests: 8 (SUCCESSES: 8, FAILURES: 0, EXCEPTIONS: 0)
133+
Tests: 8 (SUCCESSES: 8, FAILURES: 0)
134134
Failures: 0 (HIGH: 0, CRITICAL: 0)
135135

136136

137137
main.tf (terraform)
138138
===================
139-
Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
139+
Tests: 1 (SUCCESSES: 0, FAILURES: 1)
140140
Failures: 1 (HIGH: 0, CRITICAL: 1)
141141

142142
CRITICAL: Classic resources should not be used.

‎docs/docs/references/configuration/cli/trivy_config.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ trivy config [flags] DIR
3232
--ignore-policy string specify the Rego file path to evaluate each vulnerability
3333
--ignorefile string specify .trivyignore file (default ".trivyignore")
3434
--include-deprecated-checks include deprecated checks
35-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
35+
--include-non-failures include successes, available with '--scanners misconfig'
3636
--k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0)
3737
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
3838
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")

‎docs/docs/references/configuration/cli/trivy_filesystem.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ trivy filesystem [flags] PATH
5555
--ignorefile string specify .trivyignore file (default ".trivyignore")
5656
--include-deprecated-checks include deprecated checks
5757
--include-dev-deps include development dependencies in the report (supported: npm, yarn)
58-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
58+
--include-non-failures include successes, available with '--scanners misconfig'
5959
--java-db-repository strings OCI repository(ies) to retrieve trivy-java-db in order of priority (default [ghcr.io/aquasecurity/trivy-java-db:1])
6060
--license-confidence-level float specify license classifier's confidence level (default 0.9)
6161
--license-full eagerly look for licenses in source code headers and license files

‎docs/docs/references/configuration/cli/trivy_image.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ trivy image [flags] IMAGE_NAME
7272
--image-config-scanners strings comma-separated list of what security issues to detect on container image configurations (misconfig,secret)
7373
--image-src strings image source(s) to use, in priority order (docker,containerd,podman,remote) (default [docker,containerd,podman,remote])
7474
--include-deprecated-checks include deprecated checks
75-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
75+
--include-non-failures include successes, available with '--scanners misconfig'
7676
--input string input file path instead of image name
7777
--java-db-repository strings OCI repository(ies) to retrieve trivy-java-db in order of priority (default [ghcr.io/aquasecurity/trivy-java-db:1])
7878
--license-confidence-level float specify license classifier's confidence level (default 0.9)

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ trivy kubernetes [flags] [CONTEXT]
6969
--include-deprecated-checks include deprecated checks
7070
--include-kinds strings indicate the kinds included in scanning (example: node)
7171
--include-namespaces strings indicate the namespaces included in scanning (example: kube-system)
72-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
72+
--include-non-failures include successes, available with '--scanners misconfig'
7373
--java-db-repository strings OCI repository(ies) to retrieve trivy-java-db in order of priority (default [ghcr.io/aquasecurity/trivy-java-db:1])
7474
--k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0)
7575
--kubeconfig string specify the kubeconfig file path to use

‎docs/docs/references/configuration/cli/trivy_repository.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
5555
--ignorefile string specify .trivyignore file (default ".trivyignore")
5656
--include-deprecated-checks include deprecated checks
5757
--include-dev-deps include development dependencies in the report (supported: npm, yarn)
58-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
58+
--include-non-failures include successes, available with '--scanners misconfig'
5959
--java-db-repository strings OCI repository(ies) to retrieve trivy-java-db in order of priority (default [ghcr.io/aquasecurity/trivy-java-db:1])
6060
--license-confidence-level float specify license classifier's confidence level (default 0.9)
6161
--license-full eagerly look for licenses in source code headers and license files

‎docs/docs/references/configuration/cli/trivy_rootfs.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ trivy rootfs [flags] ROOTDIR
5757
--ignored-licenses strings specify a list of license to ignore
5858
--ignorefile string specify .trivyignore file (default ".trivyignore")
5959
--include-deprecated-checks include deprecated checks
60-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
60+
--include-non-failures include successes, available with '--scanners misconfig'
6161
--java-db-repository strings OCI repository(ies) to retrieve trivy-java-db in order of priority (default [ghcr.io/aquasecurity/trivy-java-db:1])
6262
--license-confidence-level float specify license classifier's confidence level (default 0.9)
6363
--license-full eagerly look for licenses in source code headers and license files

‎docs/docs/references/configuration/cli/trivy_vm.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ trivy vm [flags] VM_IMAGE
5151
--ignore-status strings comma-separated list of vulnerability status to ignore (unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life)
5252
--ignore-unfixed display only fixed vulnerabilities
5353
--ignorefile string specify .trivyignore file (default ".trivyignore")
54-
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
54+
--include-non-failures include successes, available with '--scanners misconfig'
5555
--java-db-repository strings OCI repository(ies) to retrieve trivy-java-db in order of priority (default [ghcr.io/aquasecurity/trivy-java-db:1])
5656
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
5757
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])

‎docs/docs/scanner/misconfiguration/check/exceptions.md

Lines changed: 0 additions & 92 deletions
This file was deleted.

‎docs/docs/scanner/misconfiguration/custom/debug.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ $ trivy config --trace configs/
1212

1313
Dockerfile (dockerfile)
1414
=======================
15-
Tests: 23 (SUCCESSES: 21, FAILURES: 2, EXCEPTIONS: 0)
15+
Tests: 23 (SUCCESSES: 21, FAILURES: 2)
1616
Failures: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 0)
1717

1818
MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine'

‎docs/docs/scanner/misconfiguration/custom/index.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ Some fields are displayed in scan results.
163163
k.yaml (kubernetes)
164164
───────────────────
165165

166-
Tests: 32 (SUCCESSES: 31, FAILURES: 1, EXCEPTIONS: 0)
166+
Tests: 32 (SUCCESSES: 31, FAILURES: 1)
167167
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
168168

169169
LOW: Found deployment 'my-deployment' but deployments are not allowed

‎docs/docs/scanner/misconfiguration/index.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ $ trivy config [YOUR_IaC_DIRECTORY]
2020

2121
Dockerfile (dockerfile)
2222
=======================
23-
Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
23+
Tests: 23 (SUCCESSES: 22, FAILURES: 1)
2424
Failures: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
2525

2626
MEDIUM: Specify a tag in the 'FROM' statement for image 'alpine'
@@ -75,7 +75,7 @@ You can specify `--scanners vuln,misconfig,secret` to enable vulnerability and s
7575

7676
Dockerfile (dockerfile)
7777
=======================
78-
Tests: 17 (SUCCESSES: 16, FAILURES: 1, EXCEPTIONS: 0)
78+
Tests: 17 (SUCCESSES: 16, FAILURES: 1)
7979
Failures: 1 (HIGH: 1, CRITICAL: 0)
8080

8181
HIGH: Last USER command in Dockerfile should not be 'root'
@@ -112,7 +112,7 @@ $ trivy config --severity HIGH,CRITICAL ./iac
112112

113113
Dockerfile (dockerfile)
114114

115-
Tests: 21 (SUCCESSES: 20, FAILURES: 1, EXCEPTIONS: 0)
115+
Tests: 21 (SUCCESSES: 20, FAILURES: 1)
116116
Failures: 1 (MEDIUM: 0, HIGH: 1, CRITICAL: 0)
117117

118118
HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
@@ -126,7 +126,7 @@ See https://avd.aquasec.com/misconfig/ds002
126126

127127
deployment.yaml (kubernetes)
128128

129-
Tests: 20 (SUCCESSES: 15, FAILURES: 5, EXCEPTIONS: 0)
129+
Tests: 20 (SUCCESSES: 15, FAILURES: 5)
130130
Failures: 5 (MEDIUM: 4, HIGH: 1, CRITICAL: 0)
131131

132132
MEDIUM: Container 'hello-kubernetes' of Deployment 'hello-kubernetes' should set 'securityContext.allowPrivilegeEscalation' to false
@@ -225,7 +225,7 @@ See https://avd.aquasec.com/misconfig/ksv026
225225

226226
mysql-8.8.26.tar:templates/primary/statefulset.yaml (helm)
227227

228-
Tests: 20 (SUCCESSES: 18, FAILURES: 2, EXCEPTIONS: 0)
228+
Tests: 20 (SUCCESSES: 18, FAILURES: 2)
229229
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)
230230

231231
MEDIUM: Container 'mysql' of StatefulSet 'mysql' should set 'securityContext.allowPrivilegeEscalation' to false
@@ -279,35 +279,35 @@ You can see the config type next to each file name.
279279
``` bash
280280
Dockerfile (dockerfile)
281281
=======================
282-
Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
282+
Tests: 23 (SUCCESSES: 22, FAILURES: 1)
283283
Failures: 1 (HIGH: 1, CRITICAL: 0)
284284

285285
...
286286

287287
deployment.yaml (kubernetes)
288288
============================
289-
Tests: 28 (SUCCESSES: 15, FAILURES: 13, EXCEPTIONS: 0)
289+
Tests: 28 (SUCCESSES: 15, FAILURES: 13)
290290
Failures: 13 (MEDIUM: 4, HIGH: 1, CRITICAL: 0)
291291

292292
...
293293

294294
main.tf (terraform)
295295
===================
296-
Tests: 23 (SUCCESSES: 14, FAILURES: 9, EXCEPTIONS: 0)
296+
Tests: 23 (SUCCESSES: 14, FAILURES: 9)
297297
Failures: 9 (HIGH: 6, CRITICAL: 1)
298298

299299
...
300300

301301
bucket.yaml (cloudformation)
302302
============================
303-
Tests: 9 (SUCCESSES: 3, FAILURES: 6, EXCEPTIONS: 0)
303+
Tests: 9 (SUCCESSES: 3, FAILURES: 6)
304304
Failures: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 4, CRITICAL: 0)
305305

306306
...
307307

308308
mysql-8.8.26.tar:templates/primary/statefulset.yaml (helm)
309309
==========================================================
310-
Tests: 20 (SUCCESSES: 18, FAILURES: 2, EXCEPTIONS: 0)
310+
Tests: 20 (SUCCESSES: 18, FAILURES: 2)
311311
Failures: 2 (MEDIUM: 2, HIGH: 0, CRITICAL: 0)
312312
```
313313
@@ -381,7 +381,7 @@ deny[res] {
381381
$ trivy config --misconfig-scanners=json,yaml --config-check ./serverless.rego --check-namespaces user ./iac
382382
serverless.yaml (yaml)
383383
384-
Tests: 4 (SUCCESSES: 3, FAILURES: 1, EXCEPTIONS: 0)
384+
Tests: 4 (SUCCESSES: 3, FAILURES: 1)
385385
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
386386
387387
LOW: Service name "serverless-rest-api-with-pynamodb" is not allowed

‎docs/docs/target/container_image.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ $ trivy image --image-config-scanners misconfig [YOUR_IMAGE_NAME]
119119
```
120120
alpine:3.17 (dockerfile)
121121
========================
122-
Tests: 24 (SUCCESSES: 21, FAILURES: 3, EXCEPTIONS: 0)
122+
Tests: 24 (SUCCESSES: 21, FAILURES: 3)
123123
Failures: 3 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
124124
125125
HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument

‎docs/docs/target/kubernetes.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -280,8 +280,7 @@ trivy k8s --format json -o results.json cluster
280280
"Type": "kubernetes",
281281
"MisconfSummary": {
282282
"Successes": 20,
283-
"Failures": 19,
284-
"Exceptions": 0
283+
"Failures": 19
285284
},
286285
"Misconfigurations": [
287286
{

‎integration/repo_test.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -309,15 +309,6 @@ func TestRepository(t *testing.T) {
309309
},
310310
golden: "testdata/dockerfile-rule-exception.json.golden",
311311
},
312-
{
313-
name: "dockerfile with namespace exception",
314-
args: args{
315-
scanner: types.MisconfigScanner,
316-
policyPaths: []string{"testdata/fixtures/repo/namespace-exception/policy"},
317-
input: "testdata/fixtures/repo/namespace-exception",
318-
},
319-
golden: "testdata/dockerfile-namespace-exception.json.golden",
320-
},
321312
{
322313
name: "dockerfile with custom policies",
323314
args: args{

‎integration/testdata/dockerfile-custom-policies.json.golden

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@
2222
"Type": "dockerfile",
2323
"MisconfSummary": {
2424
"Successes": 27,
25-
"Failures": 2,
26-
"Exceptions": 0
25+
"Failures": 2
2726
},
2827
"Misconfigurations": [
2928
{

‎integration/testdata/dockerfile-namespace-exception.json.golden

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎integration/testdata/dockerfile-rule-exception.json.golden

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@
2222
"Type": "dockerfile",
2323
"MisconfSummary": {
2424
"Successes": 26,
25-
"Failures": 1,
26-
"Exceptions": 0
25+
"Failures": 1
2726
},
2827
"Misconfigurations": [
2928
{

‎integration/testdata/dockerfile.json.golden

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@
2222
"Type": "dockerfile",
2323
"MisconfSummary": {
2424
"Successes": 26,
25-
"Failures": 1,
26-
"Exceptions": 0
25+
"Failures": 1
2726
},
2827
"Misconfigurations": [
2928
{

0 commit comments

Comments
 (0)