STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

All containers must be restricted from acquiring additional privileges.

DISA Rule

SV-260934r966159_rule

Vulnerability Number

V-260934

Group Title

SRG-APP-000243-CTR-000595

Rule Version

CNTR-MK-001010

Severity

CAT II

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.
• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

Start the containers using the following:

docker run --rm -it --security-opt=no-new-privileges <image>

A reference for the Docker run command can be found at https://docs.docker.com/engine/reference/run/.

no-new-privileges command information can be found here: https://docs.mirantis.com/mke/3.7/install/plan-deployment/mcr-considerations/no-new-privileges.html.

Check Contents

This check must be executed on all nodes in an MKE cluster to ensure all containers are restricted from acquiring additional privileges.

Via CLI:
Linux: As an MKE Admin, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet --all | xargs -L 1 docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'

The above command returns the security options currently configured for the running containers. If the "SecurityOpt=" setting does not include the "no-new-privileges" flag, this is a finding.

Vulnerability Number

V-260934

Documentable

False

Rule Version

CNTR-MK-001010

Severity Override Guidance

This check must be executed on all nodes in an MKE cluster to ensure all containers are restricted from acquiring additional privileges.

Via CLI:
Linux: As an MKE Admin, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet --all | xargs -L 1 docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'

The above command returns the security options currently configured for the running containers. If the "SecurityOpt=" setting does not include the "no-new-privileges" flag, this is a finding.

Check Content Reference

M

Target Key

5595