STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Use of privileged Linux containers must be limited to system containers.

DISA Rule

SV-260940r966177_rule

Vulnerability Number

V-260940

Group Title

SRG-APP-000342-CTR-000775

Rule Version

CNTR-MK-001220

Severity

CAT II

CCI(s)

• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

When using Kubernetes orchestration, this check is Not Applicable.

Review and remove nonsystem containers previously created by these users that allowed privileged execution using:

docker container rm [container]

Check Contents

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, execute the following command as a trusted user on the host operating system via CLI:

docker ps --quiet --all | grep -iv "MKE\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: Privileged={{ .HostConfig.Privileged }}'

Verify in the output that no containers are running with the --privileged flag. If there are, this is a finding.

Vulnerability Number

V-260940

Documentable

False

Rule Version

CNTR-MK-001220

Severity Override Guidance

When using Kubernetes orchestration, this check is Not Applicable.

When using Swarm orchestration, execute the following command as a trusted user on the host operating system via CLI:

docker ps --quiet --all | grep -iv "MKE\|kube\|dtr" | awk '{print $1}' | xargs docker inspect --format '{{ .Id }}: Privileged={{ .HostConfig.Privileged }}'

Verify in the output that no containers are running with the --privileged flag. If there are, this is a finding.

Check Content Reference

M

Target Key

5595