The container platform runtime must prohibit the instantiation of container images without explicit privileged status.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233185	SRG-APP-000378-CTR-000885	SV-233185r599635_rule		High

Description
Controlling access to those users and roles responsible for container image instantiation reduces the risk of untested or potentially malicious containers from being executed within the platform and on the hosting system. This access may be separate from the access required to install container images into the registry and those access requirements required to perform patch management and upgrades within the container platform. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.

Description

Controlling access to those users and roles responsible for container image instantiation reduces the risk of untested or potentially malicious containers from being executed within the platform and on the hosting system. This access may be separate from the access required to install container images into the registry and those access requirements required to perform patch management and upgrades within the container platform. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.

STIG	Date
Container Platform Security Requirements Guide	2020-11-24

Details

Check Text ( C-36121r599634_chk )
Review the container platform runtime configuration to determine if only accounts given specific container instantiation privileges can execute the container image instantiation process. Attempt to instantiate a container image using an account that does not have the proper privileges to execute the process. If container images can be instantiated using an account without the proper privileges, this is a finding.

Check Text ( C-36121r599634_chk )

Review the container platform runtime configuration to determine if only accounts given specific container instantiation privileges can execute the container image instantiation process.

Attempt to instantiate a container image using an account that does not have the proper privileges to execute the process.

If container images can be instantiated using an account without the proper privileges, this is a finding.

Fix Text (F-36089r599192_fix)
Configure the container platform runtime to prohibit the instantiation of container images without explicit container image instantiation privileges given to users.