Restrict access to cross datavolumes cloning

OrtaDüzey 1Manuel incelemeopenshift-virt

Açıklama

Datavolume cross-namespace cloning allows cloning a datavolume from one namespace to another, breaking the namespace isolation. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

To check which role bindings have the ability to clone across namespaces, use the following command where to list all the rolebinding and verify which one has a ClusterRole which enables it to operate on data volumes and have bound a service account in another namespace . Ensure that the destination namespace is a desired one. $ oc get rolebinding - n <source - namespace> <allow - clone - to - user> - oyaml Output will be in the following format: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: <role - binding - name> namespace: <source namespace> subjects: - kind: ServiceAccount name: default namespace: <destination namespace> roleRef: kind: ClusterRole name: ...

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Remove any rolebinding resources that grant unintended access across namespaces. Please refer to the latest OpenShift documentation for details on this process.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: openshift-virtmanual-review
Referans: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 3.1 Restrict access to cross datavolumes cloning