The container platform registry must employ a deny-all, permit-by-exception (whitelist) policy to allow only authorized container images in the container platform.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233192	SRG-APP-000386-CTR-000920	SV-233192r599641_rule		Medium

Description
Controlling the sources where container images can be pulled from allows the organization to define what software can be run within the container platform. Allowing any container image to be introduced and instantiated within the container platform may introduce malicious code and vulnerabilities to the platform and the hosting system. The container platform registry must deny all container images except for those signed by organizational-approved sources.

Description

Controlling the sources where container images can be pulled from allows the organization to define what software can be run within the container platform. Allowing any container image to be introduced and instantiated within the container platform may introduce malicious code and vulnerabilities to the platform and the hosting system. The container platform registry must deny all container images except for those signed by organizational-approved sources.

STIG	Date
Container Platform Security Requirements Guide	2020-11-24

Details

Check Text ( C-36128r599640_chk )
Review documentation and configuration settings to identify if the container platform whitelisting specifies which container platform components are allowed to execute. Check for the existence of policy settings or policy files that can be configured to restrict container platform component execution. Demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction. Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or Software Restriction Policies, Application Security Manager, or Role-Based Access Controls (RBAC). If container platform whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Check Text ( C-36128r599640_chk )

Review documentation and configuration settings to identify if the container platform whitelisting specifies which container platform components are allowed to execute.

Check for the existence of policy settings or policy files that can be configured to restrict container platform component execution. Demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction.

Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or Software Restriction Policies, Application Security Manager, or Role-Based Access Controls (RBAC).

If container platform whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Fix Text (F-36096r599213_fix)
Configure the container platform to utilize a deny-all, permit-by-exception policy when allowing the execution of authorized software.