TMA-DOCKER-3.4

Ensure that docker.socket file permissions are set to 644 or more restrictive

HighLevel 1Automateddocker

Description

The docker.socket unit file must have mode 644 or more restrictive so that it cannot be modified by non-root users. The audit flags any existing candidate path (/usr/lib/systemd/system/docker.socket, /lib/systemd/system/docker.socket, /etc/systemd/system/docker.socket) with permission bits outside 644; not applicable when none exists.

How it is checked

Audit method: Shell command

shell

for f in /usr/lib/systemd/system/docker.socket /lib/systemd/system/docker.socket /etc/systemd/system/docker.socket; do [ -e "$f" ] || continue; out=$(find "$f" -maxdepth 0 -perm /7133) || exit 1; [ -z "$out" ] || { echo "$f"; exit 0; }; done; echo compliant

Expected output: compliant

How it is fixed

Fix method: Shell command

shell

for f in /usr/lib/systemd/system/docker.socket /lib/systemd/system/docker.socket /etc/systemd/system/docker.socket; do if [ -e "$f" ]; then chmod 644 "$f" || exit 1; fi; done

Properties

Operating systems: Any
Tags: dockerpermissions
Reference: CIS Docker Benchmark v1.9.0 - 3.4 Ensure that docker.socket file permissions are set to 644 or more restrictive

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker