diff --git a/rules/docker/policies/update_instruction_alone.rego b/rules/docker/policies/update_instruction_alone.rego index 74a872530..1153f66bf 100644 --- a/rules/docker/policies/update_instruction_alone.rego +++ b/rules/docker/policies/update_instruction_alone.rego @@ -24,6 +24,7 @@ deny[res] { command = concat(" ", run.Value) + is_package_manager(command) is_valid_update(command) not update_followed_by_install(command) @@ -31,16 +32,15 @@ deny[res] { res := result.new(msg, run) } -is_valid_update(command) { - chained_parts := regex.split(`\s*&&\s*`, command) - - array_split := split(chained_parts[_], " ") - - len = count(array_split) +package_manager_regex := `(apk)|(apt-get)|(yum)` - update := {"update", "--update"} +is_package_manager(command) { + regex.match(package_manager_regex, command) +} - array_split[len - 1] == update[_] +update_regex := `( update)|( check-update)` +is_valid_update(command) { + regex.match(update_regex, command) } update_followed_by_install(command) { diff --git a/rules/docker/policies/update_instruction_alone_test.rego b/rules/docker/policies/update_instruction_alone_test.rego index 81fc80853..f68609230 100644 --- a/rules/docker/policies/update_instruction_alone_test.rego +++ b/rules/docker/policies/update_instruction_alone_test.rego @@ -77,16 +77,20 @@ test_allowed { }, { "Cmd": "run", - "Value": ["apt-get update && apt-get install -y --no-install-recommends mysql-client && rm -rf /var/lib/apt/lists/*"], + "Value": ["apt-get update && apt-get install -y --no-install-recommends mysql-client && rm -rf /var/lib/apt/lists/*"], }, { "Cmd": "run", - "Value": ["apk update && apk add --no-cache git ca-certificates"], + "Value": ["apk update && apk add --no-cache git ca-certificates"], }, { "Cmd": "run", "Value": ["apk --update add easy-rsa"], }, + { + "Cmd": "run", + "Value": ["/bin/sh /scripts/someScript.sh update"], + }, { "Cmd": "entrypoint", "Value": ["mysql"],