STIGQter STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Docker CLI commands must be run with an MKE client trust bundle and without unnecessary permissions.

DISA Rule

SV-260938r1015771_rule

Vulnerability Number

V-260938

Group Title

SRG-APP-000342-CTR-000775

Rule Version

CNTR-MK-001180

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Docker CLI command must only be run with a client bundle and must not use --privileged or --user option.

Refer to https://docs.mirantis.com/mke/3.7/ops/access-cluster/client-bundle/configure-client-bundle.html?highlight=client%20bundle.

Check Contents

The host OS must be locked down so that only authorized users with a client bundle can access docker commands.

To ensure that no commands with privilege or user authorizations are present via CLI:

Linux: As a trusted user on the host operating system, use the below command to filter out docker exec commands that used --privileged or --user option.

sudo ausearch -k docker | grep exec | grep privileged | grep user

If there are any in the output, then this is a finding.

Vulnerability Number

V-260938

Documentable

False

Rule Version

CNTR-MK-001180

Severity Override Guidance

The host OS must be locked down so that only authorized users with a client bundle can access docker commands.

To ensure that no commands with privilege or user authorizations are present via CLI:

Linux: As a trusted user on the host operating system, use the below command to filter out docker exec commands that used --privileged or --user option.

sudo ausearch -k docker | grep exec | grep privileged | grep user

If there are any in the output, then this is a finding.

Check Content Reference

M

Target Key

5595