cyberark / KubiScan

A tool to scan Kubernetes cluster for risky permissions

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support running on MacOS

disconnect3d opened this issue · comments

Currently the tool does not work on MacOS as there is no cgroupfs there, as used in

def running_in_docker_container():
with open('/proc/self/cgroup', 'r') as procfile:
for line in procfile:
fields = line.strip().split('/')
if 'docker' in fields or '/docker-' in line:
return True
return False

This can be fixed by checking if the running OS is MacOS and if so, not executing the is_running_in_container function.

Thank you for this update :)
Can you please check now ?

I added check to see if cgroup exist.
I am not familiar with container without it, but if there are, we can add more checks to see if this is a container.

Yes, the d4471d1 works. I think a "cleaner solution" would be to explicitly check for the operating system and don't call the running_in_docker_container in case when it is other than Linux? This could be done e.g. via:

import platform

# interestingly its docstring says:
#     Returns the system/OS name, e.g. 'Linux', 'Windows' or 'Java'.
# but it returns 'Darwin' for MacOS
os = platform.system().lower()

if os == 'linux' and running_in_docker_container():
    # ...

But I am completely fine with the current solution too.

I am not familiar with container without it, but if there are, we can add more checks to see if this is a container.

There are no native containers on MacOS and the Docker for Mac just uses a linux VM under the hood (see e.g. https://docs.docker.com/docker-for-mac/install/). Also, I don't think people run containers with e.g. procfs mounted in a different path or without cgroups. Though, we may see containers being based on cgroups v2 (which maybe produces different output of /proc/self/cgroup? not sure here).

Closing this since it works, thanks :).