Filesystem

    You have to specify to enable misconfiguration detection.

    Vulnerability and Misconfiguration scanning

    The difference between fs and config subcommand is that fs can detect both vulnerabilities and misconfiguration at the same time.

    1. $ ls myapp/
    2. Dockerfile Pipfile.lock
    3. $ trivy fs --security-checks vuln,config --severity HIGH,CRITICAL myapp/
    4. 2021-07-09T12:03:27.564+0300    INFO    Detected OS: unknown
    5. 2021-07-09T12:03:27.564+0300    INFO    Number of language-specific files: 1
    6. 2021-07-09T12:03:27.564+0300    INFO    Detecting pipenv vulnerabilities...
    7. 2021-07-09T12:03:27.566+0300    INFO    Detected config files: 1
    9. Pipfile.lock (pipenv)
    10. Total: 1 (HIGH: 1, CRITICAL: 0)
    12. +----------+------------------+----------+-------------------+---------------+---------------------------------------+
    13. | LIBRARY  | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
    14. +----------+------------------+----------+-------------------+---------------+---------------------------------------+
    15. | httplib2 | CVE-2021-21240   | HIGH     | 0.12.1            | 0.19.0        | python-httplib2: Regular              |
    16. |          |                  |          |                   |               | expression denial of                  |
    17. |          |                  |          |                   |               | service via malicious header          |
    18. |          |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-21240 |
    21. =======================
    22. Tests: 23 (SUCCESSES: 22, FAILURES: 1, EXCEPTIONS: 0)
    23. Failures: 1 (HIGH: 1, CRITICAL: 0)
    25. +---------------------------+------------+----------------------+----------+------------------------------------------+
    26. |           TYPE            | MISCONF ID |        CHECK         | SEVERITY |                 MESSAGE                  |
    27. +---------------------------+------------+----------------------+----------+------------------------------------------+
    28. | Dockerfile Security Check |   DS002    | Image user is 'root' |   HIGH   | Last USER command in                     |
    29. |                           |            |                      |          | Dockerfile should not be 'root'          |
    31. +---------------------------+------------+----------------------+----------+------------------------------------------+

    In the above example, Trivy detected vulnerabilities of Python dependencies and misconfigurations in Dockerfile.