Skip to content

Commit 22d92e4

Browse files
masahiro331knqyf263
masahiro331
and
knqyf263
authored
feat: add virtual machine scan command (#2910)
Co-authored-by: knqyf263 <[email protected]>
1 parent 531eaa8 commit 22d92e4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+2436
-144
lines changed

‎.github/workflows/semantic-pr.yaml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ jobs:
4242
sbom
4343
server
4444
k8s
45+
vm
4546
4647
alpine
4748
redhat
@@ -66,7 +67,7 @@ jobs:
6667
go
6768
c
6869
c++
69-
70+
7071
os
7172
lang
7273
@@ -82,11 +83,11 @@ jobs:
8283
8384
cli
8485
flag
85-
86+
8687
cyclonedx
8788
spdx
8889
8990
helm
9091
report
9192
db
92-
deps
93+
deps

‎.github/workflows/vm-test.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: VM Test
2+
on:
3+
push:
4+
branches:
5+
- main
6+
paths:
7+
- 'pkg/fanal/vm/**'
8+
- 'pkg/fanal/walker/vm.go'
9+
- 'pkg/fanal/artifact/vm/**'
10+
- 'integration/vm_test.go'
11+
pull_request:
12+
13+
jobs:
14+
vm-test:
15+
name: VM Integration Test
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v3
20+
21+
- name: Set up Go
22+
uses: actions/setup-go@v3
23+
with:
24+
go-version-file: go.mod
25+
- name: Run vm integration tests
26+
run: |
27+
make test-vm-integration

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ thumbs.db
2525
# test fixtures
2626
coverage.txt
2727
integration/testdata/fixtures/images
28+
integration/testdata/fixtures/vm-images
2829

2930
# SBOMs generated during CI
3031
/bom.json
@@ -33,4 +34,4 @@ integration/testdata/fixtures/images
3334
dist
3435

3536
# WebAssembly
36-
*.wasm
37+
*.wasm

‎Makefile

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,15 @@ test-integration: integration/testdata/fixtures/images/*.tar.gz
7777
test-module-integration: integration/testdata/fixtures/images/*.tar.gz $(EXAMPLE_MODULES)
7878
go test -v -tags=module_integration ./integration/...
7979

80+
# Run VM integration tests
81+
.PHONY: test-vm-integration
82+
test-vm-integration: integration/testdata/fixtures/vm-images/*.img.gz
83+
go test -v -tags=vm_integration ./integration/...
84+
85+
integration/testdata/fixtures/vm-images/*.img.gz:
86+
integration/scripts/download-vm-images.sh
87+
88+
8089
.PHONY: lint
8190
lint: $(GOBIN)/golangci-lint
8291
$(GOBIN)/golangci-lint run --timeout 5m
@@ -121,4 +130,4 @@ mkdocs-serve:
121130
# Generate JSON marshaler/unmarshaler for TinyGo/WebAssembly as TinyGo doesn't support encoding/json.
122131
.PHONY: easyjson
123132
easyjson: $(GOBIN)/easyjson
124-
easyjson pkg/module/serialize/types.go
133+
easyjson pkg/module/serialize/types.go

‎README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,15 @@
1111
[📖 Documentation][docs]
1212
</div>
1313

14-
Trivy ([pronunciation][pronunciation]) is a comprehensive and versatile security scanner. Trivy has *scanners* that look for security issues, and *targets* where it can find those issues.
14+
Trivy ([pronunciation][pronunciation]) is a comprehensive and versatile security scanner.
15+
Trivy has *scanners* that look for security issues, and *targets* where it can find those issues.
1516

1617
Targets (what Trivy can scan):
1718

1819
- Container Image
1920
- Filesystem
20-
- Git repository (remote)
21+
- Git Repository (remote)
22+
- Virtual Machine Image
2123
- Kubernetes
2224
- AWS
2325

‎docs/docs/index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ This documentation details how to use Trivy to access the features listed below.
4545

4646
Please see [LICENSE][license] for Trivy licensing information.
4747

48-
[installation]: ../index.md
48+
[installation]: ../getting-started/installation.md
4949
[vuln]: ../docs/vulnerability/scanning/index.md
5050
[misconf]: ../docs/misconfiguration/scanning.md
5151
[kubernetesoperator]: ../docs/kubernetes/operator/index.md
@@ -63,7 +63,7 @@ Please see [LICENSE][license] for Trivy licensing information.
6363
[lang]: ../docs/vulnerability/detection/language.md
6464

6565
[builtin]: ../docs/misconfiguration/policy/builtin.md
66-
[quickstart]: ../getting-started/quickstart.md
66+
[quickstart]: ../index.md
6767
[podman]: ../docs/advanced/container/podman.md
6868

6969
[sbom]: ../docs/sbom/index.md

‎docs/docs/vm/aws.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# AWS EC2
2+
3+
Trivy can scan the following targets in AWS EC2.
4+
5+
- Amazon Machine Image (AMI)
6+
- Elastic Block Store (EBS) Snapshot
7+
8+
## Amazon Machine Image (AMI)
9+
You can specify your AMI ID with the `ami:` prefix.
10+
11+
```shell
12+
$ trivy vm ami:${your_ami_id}
13+
```
14+
15+
!!! note
16+
AMIs in the marketplace are not supported because the EBS direct APIs don't support that.
17+
See [the AWS documentation][ebsapi-elements] for the detail.
18+
19+
### Example
20+
21+
```shell
22+
$ trivy vm --security-checks vuln ami:ami-0123456789abcdefg
23+
```
24+
25+
!!! tip
26+
The scanning could be faster if you enable only vulnerability scanning (`--security-checks vuln`) because Trivy tries to download only necessary blocks for vulnerability detection.
27+
28+
29+
### Required Actions
30+
Some actions on EBS are also necessary since Trivy scans an EBS snapshot tied to the specified AMI under the hood.
31+
32+
- ec2:DescribeImages
33+
- ebs:ListSnapshotBlocks
34+
- ebs:GetSnapshotBlock
35+
36+
## Elastic Block Store (EBS) Snapshot
37+
You can specify your EBS snapshot ID with the `ebs:` prefix.
38+
39+
```shell
40+
$ trivy vm ebs:${your_ebs_snapshot_id}
41+
```
42+
43+
!!! note
44+
Public snapshots are not supported because the EBS direct APIs don't support that.
45+
See [the AWS documentation][ebsapi-elements] for the detail.
46+
47+
### Example
48+
```shell
49+
$ trivy vm --security-checks vuln ebs:snap-0123456789abcdefg
50+
```
51+
52+
!!! tip
53+
The scanning could be faster if you enable only vulnerability scanning (`--security-checks vuln`) because Trivy tries to download only necessary blocks for vulnerability detection.
54+
55+
The above command takes a while as it calls EBS API and fetches the EBS blocks.
56+
If you want to scan the same snapshot several times, you can download the snapshot locally by using [coldsnap][coldsnap] maintained by AWS.
57+
Then, Trivy can scan the local VM image file.
58+
59+
```shell
60+
$ coldsnap download snap-0123456789abcdefg disk.img
61+
$ trivy vm ./disk.img
62+
```
63+
64+
### Required Actions
65+
66+
- ebs:ListSnapshotBlocks
67+
- ebs:GetSnapshotBlock
68+
69+
[ebsapi-elements]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-accessing-snapshot.html#ebsapi-elements
70+
[coldsnap]: https://github.com/awslabs/coldsnap

‎docs/docs/vm/index.md

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
# Virtual Machine Image
2+
3+
!!! warning "EXPERIMENTAL"
4+
This feature might change without preserving backwards compatibility.
5+
6+
## Scanning
7+
Trivy supports VM image scanning for vulnerabilities, secrets, etc.
8+
The following targets are currently supported:
9+
10+
- Local file
11+
- [AWS EC2][aws]
12+
13+
To scan VM images, you can use the `vm` subcommand.
14+
15+
### Local file
16+
Pass the path to your local VM image file.
17+
18+
```bash
19+
$ trivy vm --security-checks vuln disk.vmdk
20+
```
21+
22+
<details>
23+
<summary>Result</summary>
24+
25+
```
26+
disk.vmdk (amazon 2 (Karoo))
27+
===========================================================================================
28+
Total: 802 (UNKNOWN: 0, LOW: 17, MEDIUM: 554, HIGH: 221, CRITICAL: 10)
29+
30+
┌────────────────────────────┬────────────────┬──────────┬───────────────────────────────┬───────────────────────────────┬──────────────────────────────────────────────────────────────┐
31+
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
32+
├────────────────────────────┼────────────────┼──────────┼───────────────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────────────────┤
33+
│ amazon-ssm-agent │ CVE-2022-24675 │ HIGH │ 3.0.529.0-1.amzn2 │ 3.1.1575.0-1.amzn2 │ golang: encoding/pem: fix stack overflow in Decode │
34+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-24675 │
35+
├────────────────────────────┼────────────────┤ ├───────────────────────────────┼───────────────────────────────┼──────────────────────────────────────────────────────────────┤
36+
│ bind-export-libs │ CVE-2021-25215 │ │ 32:9.11.4-26.P2.amzn2.4 │ 32:9.11.4-26.P2.amzn2.5 │ bind: An assertion check can fail while answering queries │
37+
│ │ │ │ │ │ for DNAME records... │
38+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25215 │
39+
│ ├────────────────┼──────────┤ ├───────────────────────────────┼──────────────────────────────────────────────────────────────┤
40+
│ │ CVE-2021-25214 │ MEDIUM │ │ 32:9.11.4-26.P2.amzn2.5.2 │ bind: Broken inbound incremental zone update (IXFR) can │
41+
│ │ │ │ │ │ cause named to terminate... │
42+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25214 │
43+
├────────────────────────────┼────────────────┼──────────┤ ├───────────────────────────────┼──────────────────────────────────────────────────────────────┤
44+
│ bind-libs │ CVE-2021-25215 │ HIGH │ │ 32:9.11.4-26.P2.amzn2.5 │ bind: An assertion check can fail while answering queries │
45+
│ │ │ │ │ │ for DNAME records... │
46+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25215 │
47+
│ ├────────────────┼──────────┤ ├───────────────────────────────┼──────────────────────────────────────────────────────────────┤
48+
│ │ CVE-2021-25214 │ MEDIUM │ │ 32:9.11.4-26.P2.amzn2.5.2 │ bind: Broken inbound incremental zone update (IXFR) can │
49+
│ │ │ │ │ │ cause named to terminate... │
50+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25214 │
51+
├────────────────────────────┼────────────────┼──────────┤ ├───────────────────────────────┼──────────────────────────────────────────────────────────────┤
52+
│ bind-libs-lite │ CVE-2021-25215 │ HIGH │ │ 32:9.11.4-26.P2.amzn2.5 │ bind: An assertion check can fail while answering queries │
53+
│ │ │ │ │ │ for DNAME records... │
54+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25215 │
55+
│ ├────────────────┼──────────┤ ├───────────────────────────────┼──────────────────────────────────────────────────────────────┤
56+
│ │ CVE-2021-25214 │ MEDIUM │ │ 32:9.11.4-26.P2.amzn2.5.2 │ bind: Broken inbound incremental zone update (IXFR) can │
57+
│ │ │ │ │ │ cause named to terminate... │
58+
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2021-25214 │
59+
├────────────────────────────┼────────────────┼──────────┤ ├───────────────────────────────┼──────────────────────────────────────────────────────────────┤
60+
...
61+
```
62+
63+
</details>
64+
65+
### AWS EC2
66+
67+
See [here][aws] for the detail.
68+
69+
## Supported architectures
70+
71+
### Virtual machine images
72+
73+
| Image format | Support |
74+
|--------------|:-------:|
75+
| VMDK | ✔ |
76+
| OVA | |
77+
| VHD | |
78+
| VHDX | |
79+
| QCOW2 | |
80+
81+
82+
#### VMDK disk types
83+
84+
| VMDK disk type | Support |
85+
|-----------------------------|:-------:|
86+
| streamOptimized | ✔ |
87+
| monolithicSparse | |
88+
| vmfs | |
89+
| vmfsSparse | |
90+
| twoGbMaxExtentSparse | |
91+
| monolithicFlat | |
92+
| twoGbMaxExtentFlat | |
93+
| vmfsRaw | |
94+
| fullDevice | |
95+
| partitionedDevice | |
96+
| vmfsRawDeviceMap | |
97+
| vmfsPassthroughRawDeviceMap | |
98+
99+
Reference: [VMware Virtual Disk Format 1.1.pdf][vmdk]
100+
101+
102+
### Disk partitions
103+
104+
| Disk format | Support |
105+
|------------------------------|:-------:|
106+
| Master boot record (MBR) | ✔ |
107+
| Extended master boot record | |
108+
| GUID partition table (GPT) | ✔ |
109+
| Logical volume manager (LVM) | |
110+
111+
### Filesystems
112+
113+
| Filesystem format | Support |
114+
|-------------------|:-------:|
115+
| XFS | ✔ |
116+
| EXT4 | ✔ |
117+
| EXT2/3 | |
118+
| ZFS | |
119+
120+
[aws]: ./aws.md
121+
[vmdk]: https://www.vmware.com/app/vmdk/?src=vmdk

‎docs/docs/vulnerability/scanning/index.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
# Vulnerability Scanning
22

3-
Trivy scans [Container Images][image], [Rootfs][rootfs], [Filesystem][fs], and [Git Repositories][repo] to detect vulnerabilities.
4-
5-
![vulnerability][vuln]
3+
Trivy scans [Container Images][image], [Rootfs][rootfs], [Filesystem][fs], [Virtual Machine Image][vm] and [Git Repositories][repo] to detect vulnerabilities.
64

75
[image]: image.md
86
[rootfs]: rootfs.md
97
[fs]: filesystem.md
108
[repo]: git-repository.md
11-
[vuln]: ../../../imgs/vulnerability.png
9+
[vm]: ../../vm/index.md

‎docs/imgs/vulnerability.png

-846 KB
Binary file not shown.

‎docs/index.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ Targets (what Trivy can scan):
2222

2323
- Container Image
2424
- Filesystem
25-
- Git repository (remote)
25+
- Git Repository (remote)
26+
- Virtual Machine Image
2627
- Kubernetes
2728
- AWS
2829

@@ -150,8 +151,8 @@ Trivy is an [Aqua Security][aquasec] open source project.
150151
Learn about our open source work and portfolio [here][oss].
151152
Contact us about any matter by opening a GitHub Discussion [here][discussions]
152153

153-
[Ecosystem]: ./ecosystem/overview
154-
[Installation]: getting-started/installation/
154+
[Ecosystem]: ./ecosystem/index.md
155+
[Installation]: getting-started/installation.md
155156
[pronunciation]: #how-to-pronounce-the-name-trivy
156157

157158
[aquasec]: https://aquasec.com
@@ -160,4 +161,4 @@ Contact us about any matter by opening a GitHub Discussion [here][discussions]
160161

161162
[Tutorials]: ./tutorials/overview
162163
[CLI]: ./docs
163-
[Contributing]: ./contributing/issue
164+
[Contributing]: ./community/contribute/issue

0 commit comments

Comments
 (0)