TMA-DOCKER-3.4

Ensure that docker.socket file permissions are set to 644 or more restrictive

높음레벨 1자동docker

설명

The docker.socket unit file must have mode 644 or more restrictive so that it cannot be modified by non-root users. The audit flags any existing candidate path (/usr/lib/systemd/system/docker.socket, /lib/systemd/system/docker.socket, /etc/systemd/system/docker.socket) with permission bits outside 644; not applicable when none exists.

점검 방법

감사 방식: 셸 명령

shell

for f in /usr/lib/systemd/system/docker.socket /lib/systemd/system/docker.socket /etc/systemd/system/docker.socket; do [ -e "$f" ] || continue; out=$(find "$f" -maxdepth 0 -perm /7133) || exit 1; [ -z "$out" ] || { echo "$f"; exit 0; }; done; echo compliant

예상 출력: compliant

조치 방법

조치 방식: 셸 명령

shell

for f in /usr/lib/systemd/system/docker.socket /lib/systemd/system/docker.socket /etc/systemd/system/docker.socket; do if [ -e "$f" ]; then chmod 644 "$f" || exit 1; fi; done

속성

운영 체제: 모두
태그: dockerpermissions
참고 자료: CIS Docker Benchmark v1.9.0 - 3.4 Ensure that docker.socket file permissions are set to 644 or more restrictive

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target docker