66 lines
1.7 KiB
YAML
66 lines
1.7 KiB
YAML
|
---
|
||
|
|
services: docker
|
||
|
|
|
||
|
|
env:
|
||
|
|
- distro: centos6
|
||
|
|
version: latest
|
||
|
|
init: /sbin/init
|
||
|
|
|
||
|
|
- distro: centos7
|
||
|
|
init: /usr/lib/systemd/systemd
|
||
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||
|
|
version: latest
|
||
|
|
|
||
|
|
- distro: oracle6
|
||
|
|
version: latest
|
||
|
|
init: /sbin/init
|
||
|
|
|
||
|
|
- distro: oracle7
|
||
|
|
init: /usr/lib/systemd/systemd
|
||
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||
|
|
version: latest
|
||
|
|
|
||
|
|
- distro: ubuntu1604
|
||
|
|
version: latest
|
||
|
|
init: /lib/systemd/systemd
|
||
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||
|
|
|
||
|
|
- distro: ubuntu1404
|
||
|
|
version: latest
|
||
|
|
init: /sbin/init
|
||
|
|
|
||
|
|
- distro: ubuntu1204
|
||
|
|
version: latest
|
||
|
|
init: /sbin/init
|
||
|
|
|
||
|
|
- distro: debian7
|
||
|
|
version: latest
|
||
|
|
init: /sbin/init
|
||
|
|
|
||
|
|
- distro: debian8
|
||
|
|
version: latest
|
||
|
|
init: /sbin/init
|
||
|
|
|
||
|
|
- distro: debian9
|
||
|
|
version: latest
|
||
|
|
init: /lib/systemd/systemd
|
||
|
|
run_opts: "--privileged --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro"
|
||
|
|
|
||
|
|
before_install:
|
||
|
|
# Pull container
|
||
|
|
- 'docker pull rndmh3ro/docker-${distro}-ansible:${version}'
|
||
|
|
|
||
|
|
script:
|
||
|
|
- container_id=$(mktemp)
|
||
|
|
# Run container in detached state.
|
||
|
|
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-os-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
|
||
|
|
|
||
|
|
# Test role.
|
||
|
|
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/default.yml --skip-tags "sysctl"'
|
||
|
|
|
||
|
|
# Verify role
|
||
|
|
- 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-06 os-07 package-01 package-02 package-03 package-04 package-05 package-06'
|
||
|
|
|
||
|
|
notifications:
|
||
|
|
webhooks: https://galaxy.ansible.com/api/v1/notifications/
|