TMA-OPENSHIFT-VIRT-1.8

Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

MittelStufe 1Automatisiertopenshift-virt

Beschreibung

Setting the kubevirt Secure Computing Mode (seccomp) file permissions to 700 or more restrictive limits access to security related administrative functionality to approved administrators. Audit: Passes when the seccomp profile file of every virt-handler pod is mode 700 or more restrictive; a pod where the file does not exist (Secure Computing Mode feature gate not enabled) is not applicable. Requires oc logged in to the cluster with read access.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

command -v oc >/dev/null 2>&1 || exit 1; bad=0; n=0; for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name" 2>/dev/null); do n=$((n+1)); m=$(oc exec -n openshift-cnv "$pod" -c virt-handler -- sh -c 'f=/proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json; [ -e "$f" ] && stat -c %a "$f" || echo absent' 2>/dev/null); case "$m" in absent) ;; [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) [ $((8#$m & 8#077)) -eq 0 ] || bad=1;; *) bad=1;; esac; done; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Update the permissions on each node using chmod : $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700 /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json

Eigenschaften

Betriebssysteme: Beliebig
Tags: openshift-virtseccompfile-permissions
Referenz: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.8 Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target openshift-virt