STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Host IPC namespace must not be shared.

DISA Rule

SV-260935r966162_rule

Vulnerability Number

V-260935

Group Title

SRG-APP-000243-CTR-000600

Rule Version

CNTR-MK-001020

Severity

CAT II

CCI(s)

• CCI-001090 - Prevent unauthorized and unintended information transfer via shared system resources.
• CCI-002530 - Maintain a separate execution domain for each executing system process.

Weight

10

Fix Recommendation

Modify IpcMode for a container by logging in to the MKE WebUI and navigating to admin >> Admin Settings >> Privileges.
- Uncheck hostIPC.
- Click "Save".

Check Contents

Check if the "IpcMode" is set to "host" for a running or stopped container.

Log in to the MKE WebUI and Navigate to admin >> Admin Settings >> Privileges.

If hostIPC is checked for User account privileges or Service account privileges, consult the System Security Plan (SSP).

If hostIPC is not allowed per the SSP, this is a finding.

Vulnerability Number

V-260935

Documentable

False

Rule Version

CNTR-MK-001020

Severity Override Guidance

Check if the "IpcMode" is set to "host" for a running or stopped container.

Log in to the MKE WebUI and Navigate to admin >> Admin Settings >> Privileges.

If hostIPC is checked for User account privileges or Service account privileges, consult the System Security Plan (SSP).

If hostIPC is not allowed per the SSP, this is a finding.

Check Content Reference

M

Target Key

5595