Ensure that a daemon-wide custom seccomp profile is applied if appropriate

보통레벨 2수동 검토docker

설명

You can choose to apply a custom seccomp profile at a daemon-wide level if needed with this overriding Docker's default seccomp profile. A large number of system calls are exposed to every userland process with many of them not utilized during the entire lifetime of the process. Reported as a manual review item: the audit needs a site-specific judgement.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Docker 22.0 and prior You should run the command below and review the seccomp profile listed in the Security Options section. If it is default this indicates that Docker's default seccomp profile is applied. docker info --format '{{ .SecurityOptions }}' Docker 23 and later The Docker default seccomp profile is reported as profile=builtin, not default.

조치 방법

조치 방식: 가이드 또는 인프라 패치

By default, Docker's default seccomp profile is applied. If this is adequate for your environment, no action is necessary. Alternatively, if you choose to apply your own seccomp profile, use the --seccomp-profile flag at daemon start or put it in the daemon runtime parameters file. dockerd --seccomp-profile </path/to/seccomp/profile>

속성

운영 체제: 모두
태그: dockermanual
참고 자료: CIS Docker Benchmark v1.9.0 - 2.18 Ensure that a daemon-wide custom seccomp profile is applied if appropriate