TMA-DOCKER-5.24
Ensure that docker exec commands are not used with the user=root option
Açıklama
You should not use docker exec with the --user=root option. Using the --user=root option in a docker exec command, executes it within the container as the root user. This could potentially be insecure, particularly when you are running containers with reduced capabilities or ... Reported as a manual review item: the audit needs a site-specific judgement.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
If you have auditing enabled as recommended in Section 1, you can use the command below to filter out docker exec commands that use the --user=root option. ausearch -k docker | grep exec | grep user Expected state: You should not use the --user=root option in docker exec commands.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
You should not use the --user=root option in docker exec commands.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- dockermanual
- Referans
- CIS Docker Benchmark v1.9.0 - 5.24 Ensure that docker exec commands are not used with the user=root option