Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

SrednjaNivo 1Automatskaopenshift-virt

Opis

Setting the kubevirt Secure Computing Mode (seccomp) file permissions to 700 or more restrictive limits access to security related administrative functionality to approved administrators. Audit: Passes when the seccomp profile file of every virt-handler pod is mode 700 or more restrictive; a pod where the file does not exist (Secure Computing Mode feature gate not enabled) is not applicable. Requires oc logged in to the cluster with read access.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v oc >/dev/null 2>&1 || exit 1; bad=0; n=0; for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name" 2>/dev/null); do n=$((n+1)); m=$(oc exec -n openshift-cnv "$pod" -c virt-handler -- sh -c 'f=/proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json; [ -e "$f" ] && stat -c %a "$f" || echo absent' 2>/dev/null); case "$m" in absent) ;; [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) [ $((8#$m & 8#077)) -eq 0 ] || bad=1;; *) bad=1;; esac; done; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Update the permissions on each node using chmod : $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700 /proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json

Svojstva

Operativni sistemi: Bilo koji
Oznake: openshift-virtseccompfile-permissions
Referenca: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.8 Ensure kubevirt seccomp profile file permission is set to 700 or more restrictive

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target openshift-virt