TMA-DOCKER-3.4

Ensure that docker.socket file permissions are set to 644 or more restrictive

AltaNivel 1Automatizadadocker

Descripción

The docker.socket unit file must have mode 644 or more restrictive so that it cannot be modified by non-root users. The audit flags any existing candidate path (/usr/lib/systemd/system/docker.socket, /lib/systemd/system/docker.socket, /etc/systemd/system/docker.socket) with permission bits outside 644; not applicable when none exists.

Cómo se verifica

Método de auditoría: Comando de shell

shell

for f in /usr/lib/systemd/system/docker.socket /lib/systemd/system/docker.socket /etc/systemd/system/docker.socket; do [ -e "$f" ] || continue; out=$(find "$f" -maxdepth 0 -perm /7133) || exit 1; [ -z "$out" ] || { echo "$f"; exit 0; }; done; echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Comando de shell

shell

for f in /usr/lib/systemd/system/docker.socket /lib/systemd/system/docker.socket /etc/systemd/system/docker.socket; do if [ -e "$f" ]; then chmod 644 "$f" || exit 1; fi; done

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: dockerpermissions
Referencia: CIS Docker Benchmark v1.9.0 - 3.4 Ensure that docker.socket file permissions are set to 644 or more restrictive

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target docker