Added sensu check and gem files.

Author: benni-as

.gitignore

@@ -0,0 +1,10 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+/vendor/bundle

Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in quayio-scanner.gemspec
+gemspec

LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Benjamin Meichsner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

Rakefile

@@ -0,0 +1,2 @@
+require 'bundler/gem_tasks'
+task default: :spec

bin/check-container-vulnerabilities.rb

@@ -0,0 +1,49 @@
+#! /usr/bin/env ruby
+#
+#   check-container-vulnerabilities
+#
+# DESCRIPTION:
+#
+#   This plugin attempts to fetch vulnerabilties for all running containers
+#
+# OUTPUT:
+#   plain text
+#
+# PLATFORMS:
+#   Linux
+#
+# DEPENDENCIES:
+#   gem: sensu-plugin
+#   gem: docker-api
+#   gem: rest-client
+#
+# USAGE:
+#   ./check-container-vulnerabilities.rb -d <docker-url> -t <quay-io-oauth-token>
+#
+
+require 'sensu-plugin/check/cli'
+require 'quayio/scanner'
+
+class CheckContainerVulnerabilities < Sensu::Plugin::Check::CLI
+  option :docker_url,
+         description: 'Docker URL',
+         short: '-d URL',
+         long: '--docker-url URL',
+         default: 'unix:///var/run/docker.sock'
+
+  option :quayio_token,
+         description: 'Quay.io oauth token',
+         short: '-t TOKEN',
+         long: '--quayio-token TOKEN'
+
+  def run
+    result = Quayio::Scanner::Check.new(config[:docker_url],
+                                        config[:quayio_token]).run
+
+    if result[0] == :ok
+      ok result[1]
+    else
+      critical result[1]
+    end
+  end
+end

bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+require 'bundler/setup'
+require 'quayio/scanner'
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require 'irb'
+IRB.start(__FILE__)

bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

lib/quayio/scanner.rb

@@ -0,0 +1,7 @@
+require 'quayio/scanner/version'
+require 'quayio/scanner/check'
+
+module Quayio
+  module Scanner
+  end
+end

lib/quayio/scanner/check.rb

@@ -0,0 +1,26 @@
+require 'quayio/scanner/image'
+require 'docker'
+
+module Quayio
+  module Scanner
+    class Check < Struct.new(:docker_url, :quayio_token)
+      def run
+        Docker.url = docker_url
+        containers = Docker::Container.all
+                                      .map { |dc| dc.json['Config']['Image'] }
+                                      .uniq
+
+        vulnerable_images = containers
+                            .map { |container| Image.new(container, quayio_token) }
+                            .select(&:vulnerable?)
+                            .map(&:name)
+
+        if vulnerable_images.empty?
+          [:ok, "#{containers.size} Containers are ok"]
+        else
+          [:critical, "The images are insecure: #{vulnerable_images.join(', ')}"]
+        end
+      end
+    end
+  end
+end

lib/quayio/scanner/image.rb

@@ -0,0 +1,65 @@
+require 'rest-client'
+
+module Quayio
+  module Scanner
+    class Image < Struct.new(:name, :quayio_token)
+      def vulnerable?
+        quayio? && image_exists? && scanned? && high_vulnerabilities_present?
+      end
+
+      private
+
+      def quayio?
+        name.match(%r{^quay.io\/})
+      end
+
+      def image_exists?
+        raw_image
+      end
+
+      def scanned?
+        raw_scan['status'] == 'scanned'
+      end
+
+      def high_vulnerabilities_present?
+        raw_scan['data']['Layer']['Features'].detect do |f|
+          f['Vulnerabilities'] &&
+            f['Vulnerabilities'].detect { |v| v['Severity'] == 'High' }
+        end
+      end
+
+      def repo
+        name.split(':').first.gsub(%r{quay.io\/}, '')
+      end
+
+      def tag
+        name.split(':').last
+      end
+
+      def raw_image
+        return @raw_image if defined? @raw_image
+
+        @raw_image = begin
+          JSON.parse(
+            RestClient.get("https://quay.io/api/v1/repository/#{repo}/image",
+                           authorization: "Bearer #{quayio_token}", accept: :json)
+          )['images'].detect { |i| i['tags'].include?(tag) }
+        rescue RestClient::ExceptionWithResponse => err
+          return nil if err.http_code == 404 # ignore unknown repos
+          raise err
+        end
+      end
+
+      def raw_scan
+        return @raw_scan if defined? @raw_scan
+
+        @raw_scan = begin
+          JSON.parse(
+            RestClient.get("https://quay.io/api/v1/repository/#{repo}/image/#{raw_image['id']}/security?vulnerabilities=true",
+                           authorization: "Bearer #{quayio_token}", accept: :json)
+          )
+        end
+      end
+    end
+  end
+end