All,
The security team has been collaborating with the build team to evaluate tools for CVE Scanning in Starling X. This collaboration has clarified the requirements for a tool which has been documented here:
https://storyboard.openstack.org/#!/story/2005088
To fulfil these requirements, we started with evaluating tools for the host OS. These included:
Based on this, we are planning to proceed with vuls for the initial host OS reports.
We have explored a couple of open source scanners on the container scan side:
Both scanners yielded similar results identifying an CVE which needs to be corrected. Both scanners have some limitations with CentOS which we are exploring further. It seems they only identify CVEs which have already been fixed
in CentOS. This is due to the nature of the CentOS community CVE database. Currently we are learning towards Clair since It does have integration with repositories and correlates quite well to the results we are seeing from vuls.
A big thanks to Victor Rodriguez Bahena and Irene Chen for helping with this effort.
Regards,
Ken Y