STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

For MKE's deployed on an Ubuntu host operating system, the AppArmor profile must be enabled.

DISA Rule

SV-260920r966117_rule

Vulnerability Number

V-260920

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-MK-000520

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

If not using MKE on Ubuntu host operating system, this is Not Applicable.
If AppArmor is not in use, this is Not Applicable.

This check must be executed on all nodes in a cluster.

Run on all nonprivileged containers using an AppArmor profile:

Via CLI:
Linux: Install AppArmor (if not already installed).

Create/import an AppArmor profile (if not using the "docker-default" profile). Put the profile in "enforcing" model. Execute the following command as a trusted user on the host operating system to run the container using the customized AppArmor profile:

docker run [options] --security-opt="apparmor:[PROFILENAME]" [image] [command]

When using the "docker-default" default profile, run the container using the following command instead:

docker run [options] --security-opt apparmor=docker-default [image] [command]

Check Contents

If MKE is not being used on an Ubuntu host operating system, this is Not Applicable.

If AppArmor is not in use, this is Not Applicable.

This check must be executed on all nodes in a cluster.

Via CLI:
Linux: Execute the following command as a trusted user on the host operating system:

docker ps -a -q | xargs -I {} docker inspect {} --format '{{ .Name }}: AppArmorProfile={{ .AppArmorProfile }}, Privileged={{ .HostConfig.Privileged }}' | grep 'AppArmorProfile=unconfined' | grep 'Privileged=false'

If any output, this is a finding.

Vulnerability Number

V-260920

Documentable

False

Rule Version

CNTR-MK-000520

Severity Override Guidance

If MKE is not being used on an Ubuntu host operating system, this is Not Applicable.

If AppArmor is not in use, this is Not Applicable.

This check must be executed on all nodes in a cluster.

Via CLI:
Linux: Execute the following command as a trusted user on the host operating system:

docker ps -a -q | xargs -I {} docker inspect {} --format '{{ .Name }}: AppArmorProfile={{ .AppArmorProfile }}, Privileged={{ .HostConfig.Privileged }}' | grep 'AppArmorProfile=unconfined' | grep 'Privileged=false'

If any output, this is a finding.

Check Content Reference

M

Target Key

5595