Restrict exec access to the pods

中レベル 1手動レビューopenshift-virt

説明

The ability to exec commands in a pod allows for arbitrary execution by users. This includes administrative functions which normally require elevation of privileges by an approved administrator, and could lead to unauthorized use of both security and non - security related administrative functions. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

To verify who can exec commands in pods, use the following command: $ oc adm policy who - can exec pod

修正方法

修正方法: ガイダンスまたは IaC パッチ

Assign exec access to pods in the cluster only to approved administrators.

プロパティ

オペレーティングシステム: すべて
タグ: openshift-virtmanual-review
参照: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.11 Restrict exec access to the pods