# aquasecurity/linux-bench architecture

> Architecture diagram of the GitHub repository aquasecurity/linux-bench, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aquasecurity/linux-bench
- Repository: https://github.com/aquasecurity/linux-bench

## Overview

linux-bench is a command-line CIS Linux security benchmark runner. An operator invokes it with options to select a benchmark version or checks; it detects host characteristics, chooses and loads matching YAML definitions, runs checks through the external bench-common engine, and formats the results. The README also describes platform, boot-loader, logging, and LSM-based test selection. Source excerpts show the runner and detection logic; the definitions are present in the tree, but their contents and individual check behavior were not sampled.

Main entry points: [`app.go`](https://github.com/aquasecurity/linux-bench/blob/main/app.go) (Benchmark runner), [`main.go`](https://github.com/aquasecurity/linux-bench/blob/main/main.go) (Program entry), [`root.go`](https://github.com/aquasecurity/linux-bench/blob/main/root.go) (CLI options), [`utils.go`](https://github.com/aquasecurity/linux-bench/blob/main/utils.go) (Host detection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["CLI interface"]
  node_entry["Program entry<br/>[main.go]"]
  node_cli["CLI options<br/>[root.go]"]
end

subgraph group_selection["Host and benchmark selection"]
  node_host_detection["Host detection<br/>[utils.go]"]
  node_runner["Benchmark runner<br/>[app.go]"]
  node_definitions["Benchmark definitions"]
end

subgraph group_execution["Check execution"]
  node_engine["Check engine"]
end

subgraph group_results["Results"]
  node_result_format["Result formatting<br/>[app.go]"]
end

node_operator(("Operator"))
node_host["Linux host"]
node_output["Terminal or file"]

node_operator -->|"invokes"| node_entry
node_entry -->|"starts command"| node_cli
node_cli -->|"runs"| node_runner
node_runner -->|"detects host"| node_host_detection
node_host_detection -->|"queries"| node_host
node_runner -->|"selects and reads"| node_definitions
node_runner -->|"loads and runs checks"| node_engine
node_runner -->|"formats results"| node_result_format
node_result_format -->|"prints or writes"| node_output

click node_entry "https://github.com/aquasecurity/linux-bench/blob/main/main.go"
click node_cli "https://github.com/aquasecurity/linux-bench/blob/main/root.go"
click node_host_detection "https://github.com/aquasecurity/linux-bench/blob/main/utils.go"
click node_runner "https://github.com/aquasecurity/linux-bench/blob/main/app.go"
click node_definitions "https://github.com/aquasecurity/linux-bench/tree/main/cfg"
click node_result_format "https://github.com/aquasecurity/linux-bench/blob/main/app.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_cli toneBlue
class node_host_detection,node_runner,node_definitions toneAmber
class node_engine toneMint
class node_result_format toneRose
class node_operator,node_host,node_output toneIndigo
```

## Components

### CLI interface

- [Program entry](https://github.com/aquasecurity/linux-bench/blob/main/main.go): `main.go`
- [CLI options](https://github.com/aquasecurity/linux-bench/blob/main/root.go): `root.go`

### Host and benchmark selection

- [Host detection](https://github.com/aquasecurity/linux-bench/blob/main/utils.go): `utils.go`
- [Benchmark runner](https://github.com/aquasecurity/linux-bench/blob/main/app.go): `app.go`
- [Benchmark definitions](https://github.com/aquasecurity/linux-bench/tree/main/cfg): `cfg`

### Check execution

- **Check engine**

### Results

- [Result formatting](https://github.com/aquasecurity/linux-bench/blob/main/app.go): `app.go`

### Other components

- **Operator**
- **Linux host**
- **Terminal or file**

## Connections

- Operator → Program entry: invokes (evidence: `README.md`)
- Program entry → CLI options: starts command (evidence: `main.go`)
- CLI options → Benchmark runner: runs (evidence: `root.go`)
- Benchmark runner → Host detection: detects host (evidence: `app.go`)
- Host detection → Linux host: queries (evidence: `utils.go`)
- Benchmark runner → Benchmark definitions: selects and reads (evidence: `app.go`)
- Benchmark runner → Check engine: loads and runs checks (evidence: `app.go`)
- Benchmark runner → Result formatting: formats results (evidence: `app.go`)
- Result formatting → Terminal or file: prints or writes (evidence: `app.go`)