STIGQter STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

MKE users must not have permissions to create containers or pods that share the host user namespace.

DISA Rule

SV-260939r966174_rule

Vulnerability Number

V-260939

Group Title

SRG-APP-000342-CTR-000775

Rule Version

CNTR-MK-001200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, review and remove nonsystem containers previously created by these users without the runAsGroup using:

docker container rm [container]

Check Contents

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, ensure that the PIDs cgroup limit is used.

Log in to the CLI as an MKE Admin and execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UsernsMode={{ .HostConfig.UsernsMode }}'

Ensure it does not return any value for UsernsMode. If it returns a value of "host", that means the host user namespace is shared with the containers, and this is a finding.

Vulnerability Number

V-260939

Documentable

False

Rule Version

CNTR-MK-001200

Severity Override Guidance

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, ensure that the PIDs cgroup limit is used.

Log in to the CLI as an MKE Admin and execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: UsernsMode={{ .HostConfig.UsernsMode }}'

Ensure it does not return any value for UsernsMode. If it returns a value of "host", that means the host user namespace is shared with the containers, and this is a finding.

Check Content Reference

M

Target Key

5595