update refs and add tags up to control 1.10

Signed-off-by: Patrick Münch <patrick.muench1111@gmail.com>

Author: atomic111

controls/docker_host_os_level1.rb

@@ -43,7 +43,7 @@
   title 'Create a separate partition for containers'
   desc 'All Docker containers and their data and metadata is stored under /var/lib/docker directory. By default, /var/lib/docker would be mounted under / or /var partitions based on availability.'
   tag 'host'
-  ref 'http://www.projectatomic.io/docs/docker-storage-recommendation/'
+  ref 'Docker storage recommendation', url: 'http://www.projectatomic.io/docs/docker-storage-recommendation/'
 
   describe mount('/var/lib/docker') do
     it { should be_mounted }
@@ -55,8 +55,8 @@
   title 'Use the updated Linux Kernel'
   desc 'Docker in daemon mode has specific kernel requirements. A 3.10 Linux kernel is the minimum requirement for Docker.'
   tag 'host'
-  ref 'https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies'
-  ref 'https://docs.docker.com/engine/installation/#installation-list'
+  ref 'Check kernel dependencies', url: 'https://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies'
+  ref 'Installation list', url: 'https://docs.docker.com/engine/installation/#installation-list'
 
   kernel_version = command('uname -r | grep -o \'^\w\.\w*\.\w*\'').stdout
   kernel_compare = Gem::Version.new('3.10') <= Gem::Version.new(kernel_version)
@@ -71,38 +71,36 @@
   title 'Harden the container host'
   desc 'Containers run on a Linux host. A container host can run one or more containers. It is of utmost importance to harden the host to mitigate host security misconfiguration'
   tag 'host'
-  ref 'http://dev-sec.io'
-  ref 'https://docs.docker.com/articles/security/'
-  ref 'https://docs.docker.com/engine/security/security/'
-  ref 'https://benchmarks.cisecurity.org/downloads/multiform/index.cfm'
-  ref 'http://docs.docker.com/articles/security/#other-kernel-security-features'
-  ref 'https://grsecurity.net/'
-  ref 'https://en.wikibooks.org/wiki/Grsecurity'
-  ref 'https://pax.grsecurity.net/'
-  ref 'http://en.wikipedia.org/wiki/PaX'
+  ref 'Hardening Framework dev-sec.io', url: 'http://dev-sec.io'
+  ref 'Docker security article', url: 'https://docs.docker.com/engine/security/security/'
+  ref 'CIS Benchmarks', url: 'https://benchmarks.cisecurity.org/downloads/multiform/index.cfm'
+  ref 'grsecurity', url: 'https://grsecurity.net/'
+  ref 'grsecurity Wiki', url: 'https://en.wikibooks.org/wiki/Grsecurity'
+  ref 'Homepage of The PaX Team', url: 'https://pax.grsecurity.net/'
+  ref 'PAX Wiki', url: 'http://en.wikipedia.org/wiki/PaX'
 end
 
 control 'cis-docker-benchmark-1.4' do
   impact 1.0
   title 'Remove all non-essential services from the host'
   desc 'Ensure that the host running the docker daemon is running only the essential services.'
   tag 'host'
-  ref 'https://blog.docker.com/2013/08/containers-docker-how-secure-are-they/'
+  ref 'Containers & Docker: How Secure Are They?', url: 'https://blog.docker.com/2013/08/containers-docker-how-secure-are-they/'
 end
 
 control 'cis-docker-benchmark-1.5' do
   impact 1.0
   title 'Keep Docker up to date'
   desc 'The docker container solution is evolving to maturity and stability at a rapid pace. Like any other software, the vendor releases regular updates for Docker software that address security vulnerabilities, product bugs and bring in new functionality.'
   tag 'host'
-  ref 'https://docs.docker.com/installation/'
-  ref 'https://github.com/docker/docker/releases/latest'
+  ref 'Docker installation', url: 'https://docs.docker.com/installation/'
+  ref 'Docker releases', url: 'https://github.com/docker/docker/releases/latest'
 
   docker_server_version = command('docker version --format \'{{.Server.Version}}\'').stdout
-  docker_server_compare = Gem::Version.new('1.13.1') <= Gem::Version.new(docker_server_version)
+  docker_server_compare = Gem::Version.new('17.03') <= Gem::Version.new(docker_server_version)
 
   docker_client_version = command('docker version --format \'{{.Client.Version}}\'').stdout
-  docker_client_compare = Gem::Version.new('1.13.1') <= Gem::Version.new(docker_client_version)
+  docker_client_compare = Gem::Version.new('17.03') <= Gem::Version.new(docker_client_version)
 
   describe docker_server_compare do
     it { should eq true }
@@ -118,9 +116,8 @@
   title 'Only allow trusted users to control Docker daemon'
   desc 'The Docker daemon currently requires \'root\' privileges. A user added to the \'docker\' group gives him full \'root\' access rights'
   tag 'host'
-  ref 'https://docs.docker.com/articles/security/#docker-daemon-attack-surface'
-  ref 'https://www.andreas-jung.com/contents/on-docker-security-docker-group-considered-harmful'
-  ref 'http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/'
+  ref 'On Docker security: docker group considered harmful', url: 'https://www.andreas-jung.com/contents/on-docker-security-docker-group-considered-harmful'
+  ref 'Why we do not let non-root users run Docker in CentOS, Fedora, or RHEL', url: 'http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/'
 
   describe group('docker') do
     it { should exist }
@@ -136,12 +133,12 @@
   title 'Audit docker daemon'
   desc 'Apart from auditing your regular Linux file system and system calls, audit Docker daemon as well. Docker daemon runs with \'root\' privileges. It is thus necessary to audit its activities and usage.'
   tag 'host'
-  ref 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
+  ref 'System auditing', url: 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
 
   describe auditd_rules do
     its(:lines) { should include('-w /usr/bin/docker -p rwxa -k docker') }
   end
-    describe service('auditd') do
+  describe service('auditd') do
     it { should be_installed }
     it { should be_enabled }
     it { should be_running }
@@ -152,7 +149,8 @@
   impact 1.0
   title 'Audit Docker files and directories - /var/lib/docker'
   desc 'Apart from auditing your regular Linux file system and system calls, audit all Docker related files and directories. Docker daemon runs with \'root\' privileges. Its behavior depends on some key files and directories. /var/lib/docker is one such directory. It holds all the information about containers. It must be audited.'
-  ref 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
+  tag 'host'
+  ref 'System auditing', url: 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
 
   describe auditd_rules do
     its(:lines) { should include('-w /var/lib/docker/ -p rwxa -k docker') }
@@ -163,7 +161,8 @@
   impact 1.0
   title 'Audit Docker files and directories - /etc/docker'
   desc 'Apart from auditing your regular Linux file system and system calls, audit all Docker related files and directories. Docker daemon runs with \'root\' privileges. Its behavior depends on some key files and directories. /etc/docker is one such directory. It holds various certificates and keys used for TLS communication between Docker daemon and Docker client. It must be audited.'
-  ref 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
+  tag 'host'
+  ref 'System auditing', url: 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
 
   describe auditd_rules do
     its(:lines) { should include('-w /etc/docker/ -p rwxa -k docker') }
@@ -174,7 +173,8 @@
   impact 1.0
   title 'Audit Docker files and directories - docker.service'
   desc 'Apart from auditing your regular Linux file system and system calls, audit all Docker related files and directories. Docker daemon runs with \'root\' privileges. Its behavior depends on some key files and directories. docker.service is one such file. The docker.service file might be present if the daemon parameters have been changed by an administrator. It holds various parameters for Docker daemon. It must be audited, if applicable.'
-  ref 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
+  tag 'host'
+  ref 'System auditing', url: 'https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html'
 
   if docker.path
     rule = '-w ' + docker.path + ' -p rwxa -k docker'