STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Linux Kernel capabilities must be restricted within containers.

DISA Rule

SV-260923r966126_rule

Vulnerability Number

V-260923

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-MK-000560

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

When using Kubernetes orchestration this check is Not Applicable.

When using Swarm orchestration, review and remove nonsystem containers previously created by these users that allowed capabilities to be added or must be removed using:

docker container rm [container]

Check Contents

When using Kubernetes orchestration this check is Not Applicable.

When using Swarm orchestration, via CLI:

Linux: Execute the following command as a trusted user on the host operating system:

docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: CapAdd={{ .HostConfig.CapAdd }} CapDrop={{ .HostConfig.CapDrop }}'

The command will output all Linux Kernel Capabilities.

If Linux Kernel Capabilities exceed what is defined in the System Security Plan (SSP), this is a finding.

Vulnerability Number

V-260923

Documentable

False

Rule Version

CNTR-MK-000560

Severity Override Guidance

When using Kubernetes orchestration this check is Not Applicable.

When using Swarm orchestration, via CLI:

Linux: Execute the following command as a trusted user on the host operating system:

docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: CapAdd={{ .HostConfig.CapAdd }} CapDrop={{ .HostConfig.CapDrop }}'

The command will output all Linux Kernel Capabilities.

If Linux Kernel Capabilities exceed what is defined in the System Security Plan (SSP), this is a finding.

Check Content Reference

M

Target Key

5595