configsentry 0.0.12 → 0.0.13

package/dist/rules.js

@@ -137,6 +137,35 @@ export function runRules(compose, targetPath) {
                     suggestion: 'Avoid mounting /. Mount only specific directories required by the app.'
                 });
             }
+            if (v.startsWith('/dev:/dev') || v.startsWith('/dev/:/dev')) {
+                findings.push({
+                    id: 'compose.host-dev-mount',
+                    title: 'Host /dev mounted into container',
+                    severity: 'high',
+                    message: `Service '${serviceName}' mounts host /dev into the container ('${v}'), which can enable device access and privilege escalation.`,
+                    service: serviceName,
+                    path: `${targetPath}#services.${serviceName}.volumes`,
+                    suggestion: 'Avoid mounting /dev. If hardware access is required, map only the specific device(s) needed via devices:.'
+                });
+            }
+        }
+        // Rule: dangerous device mappings
+        const devices = Array.isArray(svc?.devices) ? svc.devices : [];
+        for (const d of devices) {
+            if (typeof d !== 'string')
+                continue;
+            const lower = d.toLowerCase();
+            if (lower.includes('/dev/mem') || lower.includes('/dev/kmem') || lower.includes('/dev/kmsg')) {
+                findings.push({
+                    id: 'compose.dangerous-device',
+                    title: 'Dangerous device mapped into container',
+                    severity: 'high',
+                    message: `Service '${serviceName}' maps a sensitive device into the container ('${d}').`,
+                    service: serviceName,
+                    path: `${targetPath}#services.${serviceName}.devices`,
+                    suggestion: 'Avoid mapping kernel/memory/log devices into containers. If absolutely required, isolate the host and restrict container privileges.'
+                });
+            }
         }
         // Rule: restart policy
         if (svc?.restart == null) {

package/dist/rules.test.js

@@ -41,3 +41,13 @@ test('detects unconfined security_opt', () => {
     const findings = runRules(compose, 'docker-compose.yml');
     assert.ok(findings.some((f) => f.id === 'compose.security-unconfined' && f.service === 'app'));
 });
+test('detects host /dev mount', () => {
+    const compose = { services: { app: { volumes: ['/dev:/dev'] } } };
+    const findings = runRules(compose, 'docker-compose.yml');
+    assert.ok(findings.some((f) => f.id === 'compose.host-dev-mount' && f.service === 'app'));
+});
+test('detects dangerous device mapping', () => {
+    const compose = { services: { app: { devices: ['/dev/kmsg:/dev/kmsg'] } } };
+    const findings = runRules(compose, 'docker-compose.yml');
+    assert.ok(findings.some((f) => f.id === 'compose.dangerous-device' && f.service === 'app'));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "configsentry",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "description": "Developer-first guardrails for docker-compose.yml (security + ops footguns).",
   "type": "module",
   "license": "MIT",

package/src/rules.test.ts

@@ -49,3 +49,15 @@ test('detects unconfined security_opt', () => {
   const findings = runRules(compose, 'docker-compose.yml');
   assert.ok(findings.some((f) => f.id === 'compose.security-unconfined' && f.service === 'app'));
 });
+
+test('detects host /dev mount', () => {
+  const compose = { services: { app: { volumes: ['/dev:/dev'] } } };
+  const findings = runRules(compose, 'docker-compose.yml');
+  assert.ok(findings.some((f) => f.id === 'compose.host-dev-mount' && f.service === 'app'));
+});
+
+test('detects dangerous device mapping', () => {
+  const compose = { services: { app: { devices: ['/dev/kmsg:/dev/kmsg'] } } };
+  const findings = runRules(compose, 'docker-compose.yml');
+  assert.ok(findings.some((f) => f.id === 'compose.dangerous-device' && f.service === 'app'));
+});

package/src/rules.ts

@@ -141,6 +141,35 @@ export function runRules(compose: any, targetPath: string): Finding[] {
           suggestion: 'Avoid mounting /. Mount only specific directories required by the app.'
         });
       }
+      if (v.startsWith('/dev:/dev') || v.startsWith('/dev/:/dev')) {
+        findings.push({
+          id: 'compose.host-dev-mount',
+          title: 'Host /dev mounted into container',
+          severity: 'high',
+          message: `Service '${serviceName}' mounts host /dev into the container ('${v}'), which can enable device access and privilege escalation.`,
+          service: serviceName,
+          path: `${targetPath}#services.${serviceName}.volumes`,
+          suggestion: 'Avoid mounting /dev. If hardware access is required, map only the specific device(s) needed via devices:.'
+        });
+      }
+    }
+
+    // Rule: dangerous device mappings
+    const devices: any[] = Array.isArray(svc?.devices) ? svc.devices : [];
+    for (const d of devices) {
+      if (typeof d !== 'string') continue;
+      const lower = d.toLowerCase();
+      if (lower.includes('/dev/mem') || lower.includes('/dev/kmem') || lower.includes('/dev/kmsg')) {
+        findings.push({
+          id: 'compose.dangerous-device',
+          title: 'Dangerous device mapped into container',
+          severity: 'high',
+          message: `Service '${serviceName}' maps a sensitive device into the container ('${d}').`,
+          service: serviceName,
+          path: `${targetPath}#services.${serviceName}.devices`,
+          suggestion: 'Avoid mapping kernel/memory/log devices into containers. If absolutely required, isolate the host and restrict container privileges.'
+        });
+      }
     }
 
     // Rule: restart policy