Ensure that a daemon-wide custom seccomp profile is applied if appropriate

СредњаНиво 2Ручни прегледdocker

Опис

You can choose to apply a custom seccomp profile at a daemon-wide level if needed with this overriding Docker's default seccomp profile. A large number of system calls are exposed to every userland process with many of them not utilized during the entire lifetime of the process. Reported as a manual review item: the audit needs a site-specific judgement.

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Docker 22.0 and prior You should run the command below and review the seccomp profile listed in the Security Options section. If it is default this indicates that Docker's default seccomp profile is applied. docker info --format '{{ .SecurityOptions }}' Docker 23 and later The Docker default seccomp profile is reported as profile=builtin, not default.

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

By default, Docker's default seccomp profile is applied. If this is adequate for your environment, no action is necessary. Alternatively, if you choose to apply your own seccomp profile, use the --seccomp-profile flag at daemon start or put it in the daemon runtime parameters file. dockerd --seccomp-profile </path/to/seccomp/profile>

Својства

Оперативни системи: Било који
Ознаке: dockermanual
Референца: CIS Docker Benchmark v1.9.0 - 2.18 Ensure that a daemon-wide custom seccomp profile is applied if appropriate