STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift role-based access controls (RBAC) must be enforced.

DISA Rule

SV-257513r1156752_rule

Vulnerability Number

V-257513

Group Title

SRG-APP-000033-CTR-000090

Rule Version

CNTR-OS-000090

Severity

CAT I

CCI(s)

CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
CCI-004045 - Require users to be individually authenticated before granting access to the shared accounts or resources.
CCI-001499 - Limit privileges to change software resident within software libraries.
CCI-001774 - Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.
CCI-003980 - Allow user installation of software only with explicit privileged status.
CCI-001813 - Enforce access restrictions using organization-defined mechanisms.
CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

Fix Recommendation

If users or groups exist that are bound to roles they must not have, modify the user or group permissions using the following cluster and local role binding commands:

Remove a user from a Cluster RBAC role by executing the following:
oc adm policy remove-cluster-role-from-user <role> <username>

Remove a group from a Cluster RBAC role by executing the following:
oc adm policy remove-cluster-role-from-group <role> <groupname>

Remove a user from a Local RBAC role by executing the following:
oc adm policy remove-role-from-user <role> <username>

Remove a group from a Local RBAC role by executing the following:
oc adm policy remove-role-from-group <role> <groupname>

Note: For additional information, refer to https://docs.openshift.com/container-platform/4.8/authentication/using-rbac.html.

Where OpenShift Virtualization is enabled:

1. Ensure kubevirt seccomp profile file permission is set to "700" or more restrictive:
$ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 700
/proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json

Ensure kubevirt cache directory permission is set to "755" or more restrictive:
$ oc exec <virt-handler-pod> -ti -n openshift-cnv -- chmod 755
/var/run/kubevirt-private

2. Remove create access to virtualmachineinstancemigration and migrationpolicy objects in the cluster.

Example: Remove create access given by the clusterRoleBinding for the migrationpolicy for the test user.

# Get all the users and service accounts who can create
migrationpolicies
$ oc adm policy who-can create migrationpolicy
Users: system:admin
..

Test

# Verify that the test user can create the migrationpolicy
$ oc auth can-i create migrationpolicies --as test
Warning: resource 'migrationpolicies' is not namespace scoped in group
'migrations.kubevirt.io'
yes
# Find out which rolebinding or clusterrolbinding associated to the
test user
$ oc get rolebindings,clusterrolebindings --all-namespaces -o
custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.n
ame,SERVICE_ACCOUNTS:subjects[?(@.kind=="User")].name' |grep test
ClusterRoleBinding <none>
migration-creator
test
# Inspect the cluster role binding
$ oc get clusterrolebindings migration-creator -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBindin
g","metadata":{"annotations":{},"name":"migration-creator"},"roleRef":
{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"m
igration-creator"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io"
,"kind":"User","name":"test"},{"kind":"ServiceAccount","name":"test","
namespace":"default"}]}
creationTimestamp: "2025-03-06T14:05:04Z"
name: migration-creator
resourceVersion: "1093678"
uid: 96be5dc2-2b30-4734-b5ef-16d9342bbdbf
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: migration-creator
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: test
- kind: ServiceAccount
name: test
namespace: default
# Remove the cluster role binding
$ oc delete clusterrolebindings migration-creator
clusterrolebinding.rbac.authorization.k8s.io "migration-creator"
deleted
# Re-verify that the test user cannot create the migrationpolicy
$ oc auth can-i create migrationpolicies --as test
Warning: resource 'migrationpolicies' is not namespace scoped in group
'migrations.kubevirt.io'
no

3. Add the appropriate kernel arguments to the MachineConfigPools of the workers nodes and reboot them.

Refer to https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/installation_configuration/installing-customizing#installation-special-config-kargs_installing-customizing

Default Value: OpenShift does not enable nested virtualization by default.

Check Contents

The administrator must verify OpenShift is configured with the necessary RBAC access controls.

Review the RBAC configuration.
As the cluster-admin, view the cluster roles and their associated rule sets by executing the following:
oc describe clusterrole.rbac

View the current set of cluster role bindings, which shows the users and groups that are bound to various roles, by executing the following:
oc describe clusterrolebinding.rbac

Determine local roles and bindings by executing the following:
oc describe rolebinding.rbac

If these results show users with privileged access that do not require that access, this is a finding.

Where OpenShift Virtualization is enabled:

1. Execute the following:
$ for pod in $(oc get pod -n openshift-cnv -l
kubevirt.io=virt-handler --no-headers -o
custom-columns="":metadata.name""); do
oc exec -ti -n openshift-cnv $pod -c virt-handler -- stat -c %a
/proc/1/root/var/lib/kubelet/seccomp/kubevirt/kubevirt.json
done

If the permissions are set to anything less restrictive than "700", this is a finding.

2. Execute the following:
$ for pod in $(oc get po -n openshift-cnv -l kubevirt.io=virt-handler
--no-headers -o custom-columns="":metadata.name""); do oc exec $pod
-ti -n openshift-cnv -- stat -c %a /var/run/kubevirt-private ;done

If the permissions are set to anything less restrictive than "755", this is a finding.

3. Execute the following:
$oc adm policy who-can create vmim

$ oc adm policy who-can create migrationpolicy

If these results show users with privileged access that do not require that access, this is a finding.

4. Use the following command to find users, service accounts, and groups who are allowed to create VirtualMachineInterfaceMigration and MigrationPolicy resources:
$ oc adm policy who-can create vmim

$ oc adm policy who-can create migrationpolicy

If these list users not authorized to perform namespace admin migration functions, this is a finding.

5. Execute the following:
cat /sys/module/kvm_intel/parameters/nested

If the result is "1", this is a finding.

OpenShift role-based access controls (RBAC) must be enforced.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key