TMA-DOCKER-5.26
Ensure that the container is restricted from acquiring additional privileges
AltaNivel 1Automatizadadocker
Descripción
no-new-privileges stops processes in the container gaining privileges through setuid/setgid binaries. Compliant when it is set daemon-wide in daemon.json (container SecurityOpt then stays empty) or every running container has it in SecurityOpt. The audit inspects every running container (docker ps -q) and prints the offending names; a host with no running containers is compliant.
Cómo se verifica
Método de auditoría: Comando de shell
shell
grep -Eq '"no-new-privileges"[[:space:]]*:[[:space:]]*true' /etc/docker/daemon.json 2>/dev/null && { echo compliant; exit 0; }; ids=$(docker ps -q) || exit 1; [ -z "$ids" ] && { echo compliant; exit 0; }; out=$(docker inspect --format '{{.Name}}{{range .HostConfig.SecurityOpt}} {{.}}{{end}}' $ids) || exit 1; bad=$(printf '%s\n' "$out" | awk '!/no-new-privileges(:true|=true)?( |$)/{print $1}'); [ -z "$bad" ] && echo compliant || printf '%s\n' "$bad"- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Run containers with --security-opt=no-new-privileges (compose: security_opt: ["no-new-privileges:true"]) or set "no-new-privileges": true in /etc/docker/daemon.json.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- dockerruntime
- Referencia
- CIS Docker Benchmark v1.9.0 - 5.26 Ensure that the container is restricted from acquiring additional privileges
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
shell
tmaegis scan --target docker