Ensure that docker exec commands are not used with the privileged option

高レベル 2手動レビューdocker

説明

You should not use docker exec with the --privileged option. Using the --privileged option in docker exec commands gives extended Linux capabilities to the command. This could potentially be an insecure practice, particularly when you are running containers with reduced ... Reported as a manual review item: the audit needs a site-specific judgement.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

If you have auditing enabled as recommended in Section 1, you can use the command below to filter out docker exec commands that use the --privileged option. ausearch -k docker | grep exec | grep privileged Expected state: You should not use the --privileged option in docker exec commands.

修正方法

修正方法: ガイダンスまたは IaC パッチ

You should not use the --privileged option in docker exec commands.

プロパティ

オペレーティングシステム: すべて
タグ: dockermanual
参照: CIS Docker Benchmark v1.9.0 - 5.23 Ensure that docker exec commands are not used with the privileged option