Sync security agent policies with internal repo - 11/29/2021 (#52)

* Sync with internal repo

* Sync with internal repo

* Sync with internal repo

Author: paulcacheux

compliance/containers/audit-rule-common.rego

@@ -8,7 +8,7 @@ findings[f] {
 	f := dd.passed_finding(
 		h.resource_type,
 		h.resource_id,
-		dd.audit_data(input.audit[0]),
+		h.audit_data(input.audit[0]),
 	)
 }
 

compliance/containers/cis-docker-1.2.0-1.2.2.rego

@@ -8,7 +8,7 @@ findings[f] {
 	f := dd.passed_finding(
 		h.resource_type,
 		h.resource_id,
-		dd.group_data(input.group),
+		h.group_data(input.group),
 	)
 }
 
@@ -17,7 +17,7 @@ findings[f] {
 	f := dd.failing_finding(
 		h.resource_type,
 		h.resource_id,
-		dd.group_data(input.group),
+		h.group_data(input.group),
 	)
 }
 

compliance/containers/cis-docker-1.2.0-2.1.rego

@@ -24,8 +24,8 @@ findings[f] {
 	compliant_network(network)
 	f := dd.passed_finding(
 		h.resource_type,
-		dd.docker_network_resource_id(network),
-		dd.docker_network_data(network),
+		h.docker_network_resource_id(network),
+		h.docker_network_data(network),
 	)
 }
 
@@ -34,7 +34,7 @@ findings[f] {
 	not compliant_network(network)
 	f := dd.failing_finding(
 		h.resource_type,
-		dd.docker_network_resource_id(network),
-		dd.docker_network_data(network),
+		h.docker_network_resource_id(network),
+		h.docker_network_data(network),
 	)
 }

compliance/containers/cis-docker-1.2.0-2.2.rego

@@ -24,7 +24,7 @@ findings[f] {
 	compliant(input.file, input.process)
 	f := dd.passed_finding(
 		"docker_daemon",
-		dd.docker_daemon_resource_id,
+		h.docker_daemon_resource_id,
 		{},
 	)
 }
@@ -33,7 +33,7 @@ findings[f] {
 	not compliant(input.file, input.process)
 	f := dd.failing_finding(
 		"docker_daemon",
-		dd.docker_daemon_resource_id,
+		h.docker_daemon_resource_id,
 		{},
 	)
 }

compliance/containers/cis-docker-1.2.0-3.7.rego

@@ -13,7 +13,7 @@ findings[f] {
 	f := dd.passed_finding(
 		h.resource_type,
 		h.resource_id,
-		{"files": [dd.file_data(f) | f := input.files[_]]},
+		{"files": [h.file_data(f) | f := input.files[_]]},
 	)
 }
 
@@ -22,7 +22,7 @@ findings[f] {
 	f := dd.failing_finding(
 		h.resource_type,
 		h.resource_id,
-		{"files": [dd.file_data(f) | f := input.files[_]]},
+		{"files": [h.file_data(f) | f := input.files[_]]},
 	)
 }
 

compliance/containers/cis-docker-1.2.0-3.8.rego

@@ -17,7 +17,7 @@ findings[f] {
 	f := dd.passed_finding(
 		h.resource_type,
 		h.resource_id,
-		{"files": [dd.file_data(f) | f := input.files[_]]},
+		{"files": [h.file_data(f) | f := input.files[_]]},
 	)
 }
 
@@ -27,7 +27,7 @@ findings[f] {
 	f := dd.failing_finding(
 		h.resource_type,
 		h.resource_id,
-		{"files": [dd.file_data(f) | f := input.files[_]]},
+		{"files": [h.file_data(f) | f := input.files[_]]},
 	)
 }
 

compliance/containers/cis-docker-1.2.0-4.6.rego

@@ -8,8 +8,8 @@ findings[f] {
 	valid_image[image]
 	f := dd.passed_finding(
 		h.resource_type,
-		dd.docker_image_resource_id(image),
-		dd.docker_image_data(image),
+		h.docker_image_resource_id(image),
+		h.docker_image_data(image),
 	)
 }
 
@@ -18,8 +18,8 @@ findings[f] {
 	not valid_image[image]
 	f := dd.failing_finding(
 		h.resource_type,
-		dd.docker_image_resource_id(image),
-		dd.docker_image_data(image),
+		h.docker_image_resource_id(image),
+		h.docker_image_data(image),
 	)
 }
 

compliance/containers/cis-docker-1.2.0-5.2.rego

@@ -17,8 +17,8 @@ findings[f] {
 	valid_container(c)
 	f := dd.passed_finding(
 		h.resource_type,
-		dd.docker_container_resource_id(c),
-		dd.docker_container_data(c),
+		h.docker_container_resource_id(c),
+		h.docker_container_data(c),
 	)
 }
 
@@ -28,8 +28,8 @@ findings[f] {
 	not valid_container(c)
 	f := dd.failing_finding(
 		h.resource_type,
-		dd.docker_container_resource_id(c),
-		dd.docker_container_data(c),
+		h.docker_container_resource_id(c),
+		h.docker_container_data(c),
 	)
 }
 

compliance/containers/cis-docker-1.2.0.yaml

@@ -226,7 +226,7 @@ rules:
           kind: info
         type: array
       - constants:
-          resource_type: docker_info
+          resource_type: docker_daemon
   - id: cis-docker-1.2.0-2.6
     description: TLS authentication for Docker daemon is configured
     scope:

compliance/containers/cis-kubernetes-1.5.1-1.2.14.rego

@@ -1,5 +1,11 @@
 package datadog
 
+import data.helpers as h
+
+valid_process(process) {
+	not h.has_key(process.flags, "--disable-admission-plugins")
+}
+
 valid_process(process) {
 	not regex.match("ServiceAccount", process.flags["--disable-admission-plugins"])
 }