TMA-DOCKER-5.6
Ensure sensitive host system directories are not mounted on containers
HochStufe 1Automatisiertdocker
Beschreibung
Mounting host system directories (/, /boot, /dev, /etc, /lib, /proc, /sys, /usr) lets a container read or change the host. Flags those directories mounted in any mode, and anything below them mounted read-write. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.
So wird geprüft
Prüfmethode: Shell-Befehl
shell
ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}} {{range .Mounts}} {{.Source}}|{{.RW}}{{end}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '{for(i=2;i<=NF;i++){split($i,a,"|"); if(a[1] ~ /^\/(boot|dev|etc|lib|proc|sys|usr)?$/ || (a[2]=="true" && a[1] ~ /^\/(boot|dev|etc|lib|proc|sys|usr)\//)) print $1" "a[1]}}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Redeploy the container without bind mounts of sensitive host directories; if a file is truly needed, mount only that file read-only (-v /etc/foo:/etc/foo:ro).
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- dockerruntime
- Referenz
- CIS Docker Benchmark v1.9.0 - 5.6 Ensure sensitive host system directories are not mounted on containers
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
shell
tmaegis scan --target docker