Red Hat OpenShift
TMA-OPENSHIFT-5.2.9
Minimize the admission of containers with capabilities assigned
MediaNivel 2Revisión manualopenshift
Descripción
Do not generally permit containers with capabilities. The benchmark marks this recommendation Manual.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
Use the following command to list SCCs that drop all capabilities from containers: oc get scc -A -o json | jq '.items[] | select(.requiredDropCapabilities[]?|any(. == "ALL"; .)) | .metadata.name' Verify at least one SCC is returned.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Review the use of capabilities in applications running on your cluster. Where a namespace contains applications which do not require any Linux capabilities to operate, consider adding a SCC which forbids the admission of containers which do not drop all capabilities.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- openshiftpoliciespod-security
- Referencia
- CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.2.9 Minimize the admission of containers with capabilities assigned