[Starlingx-discuss] Readout of CVE Scanning Tool Selection

[Young, Ken]

All,

The security team has been collaborating with the build team to evaluate tools for CVE Scanning in Starling X.  This collaboration has clarified the requirements for a tool which has been documented here:

https://storyboard.openstack.org/#!/story/2005088

To fulfil these requirements, we started with evaluating tools for the host OS.  These included:

  1.  cveman
     *   this tool is hardcoded to work for CLR Linux.  This does not meet the requirement to understand CVEs for CentOS and Ubuntu.
  2.  cve-check-tool<https://github.com/clearlinux/cve-check-tool> / cve-bin-tool<https://github.com/intel/cve-bin-tool>

     *   OS agnostic.
     *   Both of these tools are up-to-date with NVD
     *   Identified 10% of known CVEs
     *   Required a significant amount of manual work to extract a useful report.
  1.  vuls<https://github.com/future-architect/vuls>

     *   Understands specific OSs including CentOS and Ubuntu
     *   All data required to make decisions is provided in the report; easy to extract
     *   Identified 90% of known CVEs

Based on this, we are planning to proceed with vuls for the initial host OS reports.

We have explored a couple of open source scanners on the container scan side:

  1.  Anchore Engine<https://anchore.com/opensource>
     *   Understands specific OSs including CentOS and Ubuntu
     *   A stand-alone tool
     *   CLI only with open source; GUI with commercial version
  2.  CoreOS Clair<https://coreos.com/clair/docs/latest/>

     *   Understands specific OSs including CentOS and Ubuntu
     *   Stand-alone or integrated with a repository like Harbor
     *   May have issues integrating into a dashboard
Both scanners yielded similar results identifying an CVE which needs to be corrected.  Both scanners have some limitations with CentOS which we are exploring further.  It seems they only identify CVEs which have already been fixed in CentOS.  This is due to the nature of the CentOS community CVE database.  Currently we are learning towards Clair since It does have integration with repositories and correlates quite well to the results we are seeing from vuls.

A big thanks to Victor Rodriguez Bahena and Irene Chen for helping with this effort.

Regards,
Ken Y

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190227/52c72a6a/attachment-0001.html>