Restrict exec access to the pods

MoyenneNiveau 1Revue manuelleopenshift-virt

Description

The ability to exec commands in a pod allows for arbitrary execution by users. This includes administrative functions which normally require elevation of privileges by an approved administrator, and could lead to unauthorized use of both security and non - security related administrative functions. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

To verify who can exec commands in pods, use the following command: $ oc adm policy who - can exec pod

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Assign exec access to pods in the cluster only to approved administrators.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: openshift-virtmanual-review
Référence: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.11 Restrict exec access to the pods