STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

MKE must not permit users to create pods that share host process namespace.

DISA Rule

SV-260930r966147_rule

Vulnerability Number

V-260930

Group Title

SRG-APP-000148-CTR-000345

Rule Version

CNTR-MK-000680

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

When using Kubernetes orchestration, this check is Not Applicable.

Using Swarm orchestration, review and remove nonsystem containers previously created by these users utilizing shared namespaces or with a PidMode=host using the following:

docker container rm [container]

Check Contents

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, to ensure the host's process namespace is not shared, log in via CLI:

Execute the following using the MKE client bundle:

container_ids=$(docker ps --quiet --filter=label=com.docker.ucp.version)
for container_id in $container_ids
do
container_name=$(docker inspect -f '{{.Name}}' $container_id | cut -c2-)
pid_mode=$(docker inspect -f '{{.HostConfig.PidMode}}' $container_id)

echo "Container Name: $container_name, ID: $container_id, PidMode: $pid_mode"
done

If PidMode = "host", this is a finding.

Vulnerability Number

V-260930

Documentable

False

Rule Version

CNTR-MK-000680

Severity Override Guidance

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, to ensure the host's process namespace is not shared, log in via CLI:

Execute the following using the MKE client bundle:

container_ids=$(docker ps --quiet --filter=label=com.docker.ucp.version)
for container_id in $container_ids
do
container_name=$(docker inspect -f '{{.Name}}' $container_id | cut -c2-)
pid_mode=$(docker inspect -f '{{.HostConfig.PidMode}}' $container_id)

echo "Container Name: $container_name, ID: $container_id, PidMode: $pid_mode"
done

If PidMode = "host", this is a finding.

Check Content Reference

M

Target Key

5595