Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

MoyenneNiveau 1Automatiséeopenshift-virt

Description

Setting the kubevirt Secure Computing Mode (seccomp) file permissions to 700 or more restrictive limits access to security related administrative functionality to approved administrators. Audit: Passes when the seccomp profile file of every virt-handler pod is mode 700 or more restrictive; a pod where the file does not exist (Secure Computing Mode feature gate not enabled) is not applicable. Requires oc logged in to the cluster with read access.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v oc >/dev/null 2>&1 || exit 1; bad=0; n=0; for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name" 2>/dev/null); do n=$((n+1)); m=$(oc exec -n openshift-cnv "$pod" -c virt-handler -- sh -c 'f=/proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json; [ -e "$f" ] && stat -c %a "$f" || echo absent' 2>/dev/null); case "$m" in absent) ;; [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) [ $((8#$m & 8#077)) -eq 0 ] || bad=1;; *) bad=1;; esac; done; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Update the permissions on each node using chmod : $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700 /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: openshift-virtseccompfile-permissions
Référence: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.8 Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target openshift-virt