Restrict exec access to the pods

MediaNivel 1Revisión manualopenshift-virt

Descripción

The ability to exec commands in a pod allows for arbitrary execution by users. This includes administrative functions which normally require elevation of privileges by an approved administrator, and could lead to unauthorized use of both security and non - security related administrative functions. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

To verify who can exec commands in pods, use the following command: $ oc adm policy who - can exec pod

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Assign exec access to pods in the cluster only to approved administrators.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: openshift-virtmanual-review
Referencia: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.11 Restrict exec access to the pods