diff --git a/Atomic/scan.py b/Atomic/scan.py
index e5b050b..fecf92a 100644
--- a/Atomic/scan.py
+++ b/Atomic/scan.py
@@ -12,14 +12,15 @@ def cli(subparser):
# atomic scan
scanners = util.get_scanners()
scanp = subparser.add_parser(
- "scan", help=_("scan an image or container for CVEs"),
- epilog="atomic scan scans a container or image for CVEs")
+ "scan", help=_("scan an image or container for CVEs or configuration compliance"),
+ epilog="atomic scan scans a container or image for CVEs or configuration compliance")
scanp.set_defaults(_class=Scan, func='scan')
scan_group = scanp.add_mutually_exclusive_group()
scanp.add_argument("scan_targets", nargs='*', help=_("container image"))
scanp.add_argument("--scanner", choices=[x['scanner_name'] for x in scanners], default=None, help=_("define the intended scanner"))
scanp.add_argument("--scan_type", default=None, help=_("define the intended scan type"))
scanp.add_argument("--list", action='store_true', default=False, help=_("List available scanners"))
+ scanp.add_argument("--scanner_args", default=None, help=_("Specify arguments to be passed to the scanner"))
disp_group = scanp.add_mutually_exclusive_group()
disp_group.add_argument("--verbose", action='store_true', default=False, help=_("Show more output from scanning container"))
disp_group.add_argument("--json", action='store_true', default=False, help=_("Output results in JSON format"))
@@ -82,6 +83,17 @@ class Scan(Atomic):
if self.scanner not in [x['scanner_name'] for x in self.scanners]:
raise ValueError("Unknown scanner '{}' defined in {}".format(self.scanner, util.ATOMIC_CONF))
+ def get_additional_args():
+ if self.args.scanner_args is None:
+ return []
+ additional_args = []
+ for pair in self.args.scanner_args.split(","):
+ key, _, value = pair.partition("=")
+ additional_args.append("--" + key.strip())
+ if value:
+ additional_args.append(value.strip())
+ return additional_args
+
if self.args.debug:
self.debug = True
@@ -140,7 +152,7 @@ class Scan(Atomic):
scan_cmd = docker_args + security_args
if custom_args is not None:
scan_cmd = scan_cmd + custom_args
- scan_cmd = scan_cmd + [scanner_image_name] + scanner_args
+ scan_cmd = scan_cmd + [scanner_image_name] + scanner_args + get_additional_args()
scan_cmd = self.sub_env_strings(" ".join(scan_cmd))
# Show the command being run
diff --git a/atomic.d/openscap b/atomic.d/openscap
index 2aa554e..b94bd79 100644
--- a/atomic.d/openscap
+++ b/atomic.d/openscap
@@ -9,7 +9,11 @@ scans: [
description: "Performs a CVE scan based on Red Hat relesead CVE OVAL. !WARNING! This CVE is built into container image and it might be out-of-date. Change config.ini to configure the scanner to fetch latest CVE data"},
{ name: standards_compliance,
args: ['oscapd-evaluate', 'scan', '--targets', 'chroots-in-dir:///scanin', '--output', '/scanout', '--no-cve-scan', '-j1'],
- description: "Performs scan with Standard Profile, as present in Scap Security Guide shipped in Red Hat Enterprise Linux"
+ description: "!DEPRECATED! Performs scan with Standard Profile, as present in SCAP Security Guide shipped in Red Hat Enterprise Linux"
+ },
+ { name: configuration_compliance,
+ args: ['oscapd-evaluate', 'scan', '--targets', 'chroots-in-dir:///scanin', '--output', '/scanout', '--no-cve-scan', '-j1'],
+ description: "Performs a configuration compliance scan according to selected profile from SCAP Security Guide shipped in Red Hat Enterprise Linux."
}
]
diff --git a/bash/atomic b/bash/atomic
index 4aeb0c3..406513f 100644
--- a/bash/atomic
+++ b/bash/atomic
@@ -253,6 +253,7 @@ _atomic_scan() {
--scanner
--scan_type
--verbose
+ --scanner_args
"
[ "$command" = "scan" ] && all_options="$all_options"
diff --git a/docs/atomic-scan.1.md b/docs/atomic-scan.1.md
index 9f72552..6b5f532 100644
--- a/docs/atomic-scan.1.md
+++ b/docs/atomic-scan.1.md
@@ -38,6 +38,9 @@ Select as scanner other than the default.
**--scan_type**
Select a scan_type other than the default.
+**--scanner_args**
+ Provide additional arguments for the scanner, for example specify a compliance profile.
+
**--all**
Instead of providing image or container names, scan all images (excluding intermediate image layers) and containers