OpenShift Virtualization
TMA-OPENSHIFT-VIRT-1.11
Restrict exec access to the pods
OrtaDüzey 1Manuel incelemeopenshift-virt
Açıklama
The ability to exec commands in a pod allows for arbitrary execution by users. This includes administrative functions which normally require elevation of privileges by an approved administrator, and could lead to unauthorized use of both security and non - security related administrative functions. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
To verify who can exec commands in pods, use the following command: $ oc adm policy who - can exec pod
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Assign exec access to pods in the cluster only to approved administrators.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- openshift-virtmanual-review
- Referans
- CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.11 Restrict exec access to the pods