From d0eae6480d95ead463e5e92359df0c1f0caeb2b8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 16 Oct 2016 15:13:04 +0200
Subject: [PATCH] Support for Docker container detection

---
 include/consts    |  1 +
 include/functions | 26 ++++++++++++++++++++++++++
 lynis             |  8 ++++++++
 3 files changed, 35 insertions(+)

diff --git a/include/consts b/include/consts
index c556ef4b..ff3d214d 100644
--- a/include/consts
+++ b/include/consts
@@ -77,6 +77,7 @@ unset LANG
     CONTROL_URL_APPEND=""
     CONTROL_URL_PREPEND=""
     CONTROL_URL_PROTOCOL=""
+    CONTAINER_TYPE=""
     CREATE_REPORT_FILE=1
     CSUMBINARY=""
     CUSTOM_URL_APPEND=""
diff --git a/include/functions b/include/functions
index db0d40ae..e5cbe30c 100644
--- a/include/functions
+++ b/include/functions
@@ -50,6 +50,7 @@
 #    GetHostID                  Retrieve an unique ID for this host
 #    InsertSection              Insert a section block
 #    InsertPluginSection        Insert a section block for plugins
+#    IsContainer                Determine if program runs in a container
 #    IsDebug                    Check if --debug is used
 #    IsDeveloperMode            Check if --developer is used
 #    IsDeveloperVersion         Check if program is a developer release
@@ -1075,6 +1076,31 @@
     }
 
 
+    ################################################################################
+    # Name        : IsContainer()
+    # Description : Determine if we are running in a container
+    # Returns     : Exit code (0 = true, 1 = false)
+    #               CONTAINER_TYPE
+    ################################################################################
+
+    IsContainer() {
+        FOUND=0
+        if [ /proc/1/cgroups ]; then
+            FIND=$(cat /proc/1/cgroups | grep -i docker)
+            if [ $? -eq 0 ]; then
+                LogText "Result: found Docker in cgroups, so we are running in Docker container"
+                CONTAINER_TYPE="Docker"; FOUND=1
+                EXITCODE=0
+            fi
+        fi
+        if [ ${FOUND} -eq 0 ]; then
+            CONTAINER_TYPE=""
+            EXITCODE=1
+        fi
+        return ${EXITCODE}
+    }
+
+
     ################################################################################
     # Name        : IsDebug()
     # Description : Check if --debug option is used to show more details
diff --git a/lynis b/lynis
index 0aa0fff1..3a0954ec 100755
--- a/lynis
+++ b/lynis
@@ -750,6 +750,14 @@ ${NORMAL}
 #
     # Use hardware detection capabilities
     IsVirtualMachine
+    if IsContainer; then
+        LogText "Result: ${PROGRAM_NAME} is running in container (${CONTAINER_TYPE})"
+        Report "container=1"
+        Report "container_type=${CONTAINER_TYPE}"
+    else
+        LogText "Result: ${PROGRAM_NAME} is not running in container"
+        Report "container=0"
+    fi
     IsNotebook
 #
 #################################################################################