Ensure that docker exec commands are not used with the privileged option

TinggiLevel 2Tinjauan manualdocker

Deskripsi

You should not use docker exec with the --privileged option. Using the --privileged option in docker exec commands gives extended Linux capabilities to the command. This could potentially be an insecure practice, particularly when you are running containers with reduced ... Reported as a manual review item: the audit needs a site-specific judgement.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

If you have auditing enabled as recommended in Section 1, you can use the command below to filter out docker exec commands that use the --privileged option. ausearch -k docker | grep exec | grep privileged Expected state: You should not use the --privileged option in docker exec commands.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

You should not use the --privileged option in docker exec commands.

Properti

Sistem operasi: Apa saja
Tag: dockermanual
Referensi: CIS Docker Benchmark v1.9.0 - 5.23 Ensure that docker exec commands are not used with the privileged option