Minimize access to privileged Security Context Constraints

DüşükDüzey 2Manuel incelemeopenshift

Açıklama

OpenShift has the concept of Security Context Constraints (SCCs) that supplement the Pod Security Admission controller. SCCs allow you to group elevated container capabilities and assign those capabilities to users and groups. For example, you can have an SCC that restricts the ability to launch privileged containers and assign that SCC to all authenticated users. The benchmark marks this recommendation Manual.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Find all users and groups with access to SCCs that include privileged or elevated capabilities: oc get scc -ojson | jq '.items[]|select(.allowHostIPC or .allowHostPID or .allowHostPorts or .allowHostNetwork or .allowHostDirVolumePlugin or .allowPrivilegedContainer or .runAsUser.type != "MustRunAsRange" )|.metadata.name,{"Group:":.groups},{"User":.users}' Review the returned users and groups and verify they actually need access to those SCCs.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Remove any users and groups who do not need access to an SCC, following the principle of least privilege. You can remove users and groups from an SCC using the oc edit scc $NAME command. Additionally, you can create your own SCCs that contain the container functionality you need for a particular use case and assign that SCC to users and groups if the default SCCs are not appropriate for your use case.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: openshiftpoliciesrbacpod-security
Referans: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.2.10 Minimize access to privileged Security Context Constraints