STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must enforce network policy on the namespace for controlling the flow of information within the container platform based on organization-defined information flow control policies.

DISA Rule

SV-257514r1208195_rule

Vulnerability Number

V-257514

Group Title

SRG-APP-000038-CTR-000105

Rule Version

CNTR-OS-000100

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Add a network policy to an existing project namespace by performing the following steps:

1. Create <YOURFILE>.yaml and insert the desired resource network policy content. The following is an example resource quota definition:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-same-namespace
namespace: <NAMESPACE>
spec:
podSelector: {}
ingress:
- from:
- podSelector: {}

2. Apply the network policy definition to the project namespace by executing the following:
oc apply -f <YOURFILE>.yaml -n <NAMESPACE>

Details regarding the configuration of resource network policy can be reviewed at https://docs.openshift.com/container-platform/4.12/networking/network_policy/about-network-policy.html.

Where OpenShift Virtualization is enabled:
Enable MAC-spoof filtering per the deployed networking provider instructions.

Instructions for Bridge CNI and SR-IOV CNI:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/virtualization/networking#virt-creating-linux-bridge-nad-cli_virt-connecting-vm-to-linux-bridge
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/virtualization/networking#nw-sriov-network-attachment_virt-connecting-vm-to-sriov

Check Contents

Verify each user namespace has a network policy by executing the following:

for ns in $(oc get namespaces -ojson | jq -r '.items[] | select((.metadata.name | startswith('openshift') | not) and (.metadata.name | startswith('kube-') | not) and .metadata.name != 'default') | .metadata.name '); do oc get networkpolicy -n$ns; done

If the above returns any lines saying "No resources found in <PROJECT> namespace.", this is a finding. Empty output is not a finding.

Where OpenShift Virtualization is enabled:

For SR-IOV, use the following command:
$ oc get sriovnetwork -o json | jq ".items[].spec.spoofChk"

If these results show the setting is off for any network, this is a finding.

For Bridge CNI, use the following command:
$ oc get networkattachmentdefinition -o json | jq
".items[].spec.config.macspoofchk"

If these results show the setting is false for any network, this is a finding.

Vulnerability Number

V-257514

Documentable

False

Rule Version

CNTR-OS-000100

Severity Override Guidance

Verify each user namespace has a network policy by executing the following:

for ns in $(oc get namespaces -ojson | jq -r '.items[] | select((.metadata.name | startswith('openshift') | not) and (.metadata.name | startswith('kube-') | not) and .metadata.name != 'default') | .metadata.name '); do oc get networkpolicy -n$ns; done

If the above returns any lines saying "No resources found in <PROJECT> namespace.", this is a finding. Empty output is not a finding.

Where OpenShift Virtualization is enabled:

For SR-IOV, use the following command:
$ oc get sriovnetwork -o json | jq ".items[].spec.spoofChk"

If these results show the setting is off for any network, this is a finding.

For Bridge CNI, use the following command:
$ oc get networkattachmentdefinition -o json | jq
".items[].spec.config.macspoofchk"

If these results show the setting is false for any network, this is a finding.

Check Content Reference

M

Target Key

5547