Red Hat OpenShift
TMA-OPENSHIFT-5.2.6
Minimize the admission of root containers
Descrição
Do not generally permit containers to be run as the root user. The benchmark marks this recommendation Manual.
Como é verificado
Método de auditoria: Revisão manual
Use the following command to list all SCCs that restrict the ability to run the container as root: oc get scc -A -o json | jq '.items[] | select(.runAsUser["type"] == "MustRunAsNonRoot") | .metadata.name' Verify at least one SCC is returned. You can perform additional validation by using the following command to list the UID range for each SCC: for i in `oc get scc --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}'`; do echo "$i"; oc describe scc $i | grep "\sUID"; done Verify there is at least one SCC that doesn't contain 0 in the UID range.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
None required. By default, OpenShift includes the nonroot and nonroot-v2 SCCs that restrict the ability to run as nonroot. If additional SCCs are appropriate, follow the OpenShift documentation to create custom SCCs.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- openshiftpoliciespod-security
- Referência
- CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.2.6 Minimize the admission of root containers