Ensure kubevirt cache directory permission is set to 755 or more restrictive

보통레벨 1자동openshift-virt

설명

Setting the kubevirt private directory to 755 or more restrictive limits access to security related administrative functionality to approved administrators. Audit: Passes when /var/run/kubevirt-private in every virt-handler pod is mode 755 or more restrictive; a pod where the directory does not exist is not applicable. Requires oc logged in to the cluster with read access.

점검 방법

감사 방식: 셸 명령

shell

command -v oc >/dev/null 2>&1 || exit 1; bad=0; n=0; for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name" 2>/dev/null); do n=$((n+1)); m=$(oc exec -n openshift-cnv "$pod" -- sh -c '[ -e /var/run/kubevirt-private ] && stat -c %a /var/run/kubevirt-private || echo absent' 2>/dev/null); case "$m" in absent) ;; [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) [ $((8#$m & ~8#755 & 8#7777)) -eq 0 ] || bad=1;; *) bad=1;; esac; done; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Update the permissions on each virt-handller using : chmod $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 755 /var/run/kubevirt-private

속성

운영 체제: 모두
태그: openshift-virtfile-permissions
참고 자료: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.9 Ensure kubevirt cache directory permission is set to 755 or more restrictive

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target openshift-virt