Red Hat OpenShift
TMA-OPENSHIFT-5.2.5
Minimize the admission of containers with allowPrivilegeEscalation
VisokaNivo 1Ručni pregledopenshift
Opis
Do not generally permit containers to be run with the allowPrivilegeEscalation flag set to true. The benchmark marks this recommendation Manual.
Kako se proverava
Metod provere: Ručni pregled
Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.
Use the following command to list all SCCs with allowPrivilegeEscalation set to false: oc get scc -A -o json | jq '.items[] | select(.allowPrivilegeEscalation==false) | .metadata.name' Verify that there is at least one SCC is returned.
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Create an SCC that sets allowPrivilegeEscalation to false and take it into use by assigning it to applicable users and groups.
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- openshiftpoliciespod-security
- Referenca
- CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation