Ensure that the seccomp profile is set to docker/default in your pod definitions

DüşükDüzey 2Manuel incelemeopenshift

Açıklama

Enable default seccomp profile in your pod definitions. The benchmark marks this recommendation Manual.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

In OpenShift 4, CRI-O is the supported runtime. CRI-O runs unconfined by default in order to meet CRI conformance criteria. On Red Hat CoreOS, the default seccomp policy is associated with CRI-O and stored in /etc/crio/seccomp.json. The default profile is applied when the user asks for the RuntimeDefault profile via annotation to the pod and when the associated SCC allows use of the specified seccomp profile.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For any non-privileged pods or containers that do not have seccomp profiles, consider using the RuntimeDefault or creating a custom seccomp profile specifically for the workload. Please refer to the OpenShift documentation for working with custom seccomp profiles.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: openshiftpoliciespod-security
Referans: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions