Docker
TMA-DOCKER-1.1.3
Ensure auditing is configured for the Docker daemon
MediumLevel 1Automateddocker
Description
Auditing the Docker daemon binary /usr/bin/dockerd records changes and use of a security-critical Docker component, supporting incident investigation. The audit lists the loaded kernel audit rules (auditctl -l, needs root) and looks for a watch on /usr/bin/dockerd. Not applicable when the Docker daemon binary /usr/bin/dockerd is not present.
How it is checked
Audit method: Shell command
shell
out=$(auditctl -l 2>/dev/null) || exit 1; printf '%s\n' "$out" | grep -q -e '/usr/bin/dockerd' && echo compliant || echo missing- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Add '-w /usr/bin/dockerd -k docker' to /etc/audit/rules.d/docker.rules, then load it with 'augenrules --load' (or restart auditd).
Properties
- Operating systems
- Any
- Tags
- dockerauditdhost
- Reference
- CIS Docker Benchmark v1.9.0 - 1.1.3 Ensure auditing is configured for the Docker daemon
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker