Ensure kubevirt cache directory permission is set to 755 or more restrictive

OrtaDüzey 1Otomatikopenshift-virt

Açıklama

Setting the kubevirt private directory to 755 or more restrictive limits access to security related administrative functionality to approved administrators. Audit: Passes when /var/run/kubevirt-private in every virt-handler pod is mode 755 or more restrictive; a pod where the directory does not exist is not applicable. Requires oc logged in to the cluster with read access.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

command -v oc >/dev/null 2>&1 || exit 1; bad=0; n=0; for pod in $(oc get pod -n openshift-cnv -l kubevirt.io=virt-handler --no-headers -o custom-columns=":metadata.name" 2>/dev/null); do n=$((n+1)); m=$(oc exec -n openshift-cnv "$pod" -- sh -c '[ -e /var/run/kubevirt-private ] && stat -c %a /var/run/kubevirt-private || echo absent' 2>/dev/null); case "$m" in absent) ;; [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) [ $((8#$m & ~8#755 & 8#7777)) -eq 0 ] || bad=1;; *) bad=1;; esac; done; [ "$n" -gt 0 ] || exit 1; [ "$bad" -eq 0 ] && echo compliant || echo noncompliant

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Update the permissions on each virt-handller using : chmod $ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 755 /var/run/kubevirt-private

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: openshift-virtfile-permissions
Referans: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.9 Ensure kubevirt cache directory permission is set to 755 or more restrictive

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target openshift-virt