STIGQter STIGQter: STIG Summary: Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

All Docker Enterprise containers must be restricted from acquiring additional privileges.

DISA Rule

SV-235816r672380_rule

Vulnerability Number

V-235816

Group Title

SRG-APP-000141

Rule Version

DKER-EE-002110

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.

Start the containers as below:

docker run --rm -it --security-opt=no-new-privileges <image>

A reference for the docker run command can be found at https://docs.docker.com/engine/reference/run/.

Check Contents

This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.

Ensure all containers are restricted from acquiring additional privileges.

via CLI:

Linux: As a Docker EE Admin, execute the following command using a Universal Control Plane (UCP) client bundle:

docker ps --quiet --all | xargs -L 1 docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'

The above command returns the security options currently configured for the running containers, if 'SecurityOpt=' setting does not include the 'no-new-privileges' flag, this is a finding."

Vulnerability Number

V-235816

Documentable

False

Rule Version

DKER-EE-002110

Severity Override Guidance

This check only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.

Ensure all containers are restricted from acquiring additional privileges.

via CLI:

Linux: As a Docker EE Admin, execute the following command using a Universal Control Plane (UCP) client bundle:

docker ps --quiet --all | xargs -L 1 docker inspect --format '{{ .Id }}: SecurityOpt={{ .HostConfig.SecurityOpt }}'

The above command returns the security options currently configured for the running containers, if 'SecurityOpt=' setting does not include the 'no-new-privileges' flag, this is a finding."

Check Content Reference

M

Target Key

5281

Comments