Minimize the admission of containers with added capabilities

MoyenneNiveau 1Revue manuelleopenshift

Description

Do not generally permit containers with capabilities assigned beyond the default set. The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Use the following command to list all SCCs that prohibit users from defining container capabilities: oc get scc -A -o json | jq '.items[] | select(.allowedCapabilities==null) | .metadata.name' Verify at least one SCC is returned. Additionally, use the following command to list all SCCs that do not set default container capabilities: oc get scc -A -o json | jq '.items[] | select(.defaultAddCapabilities==null) | .metadata.name' Verify at least one SCC is returned.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Utilize the restricted-v2 SCC or create an SCC that sets allowedCapabilities and defaultAddCapabilities to an empty list and take it into use by assigning it to applicable users and groups.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: openshiftpoliciespod-security
Référence: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.2.8 Minimize the admission of containers with added capabilities