STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The default seccomp profile must not be disabled.

DISA Rule

SV-260937r966168_rule

Vulnerability Number

V-260937

Group Title

SRG-APP-000342-CTR-000775

Rule Version

CNTR-MK-001170

Severity

CAT II

CCI(s)

• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, do not pass unconfined flags to run a container without the default seccomp profile. Refer to seccomp documentation for details: https://docs.docker.com/engine/security/seccomp/.

Check Contents

When using Kubernetes orchestration, this check is Not Applicable.

For Swarm orchestration, to ensure the default seccomp profile is not disabled, log in to the CLI:

Linux: As an MKE Admin, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet --filter "label=com.docker.ucp.version" | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'

If seccomp:=unconfined, then the container is running without any seccomp profiles and this is a finding.

Vulnerability Number

V-260937

Documentable

False

Rule Version

CNTR-MK-001170

Severity Override Guidance

When using Kubernetes orchestration, this check is Not Applicable.

For Swarm orchestration, to ensure the default seccomp profile is not disabled, log in to the CLI:

Linux: As an MKE Admin, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet --filter "label=com.docker.ucp.version" | xargs docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'

If seccomp:=unconfined, then the container is running without any seccomp profiles and this is a finding.

Check Content Reference

M

Target Key

5595