The container platform must prohibit containers from accessing privileged resources.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233127	SRG-APP-000243-CTR-000595	SV-233127r601753_rule		Medium

Description
Containers images instantiated within the container platform may request access to host system resources. Access to privileged resources can allow for unauthorized and unintended transfer of information, but in some cases, these resources may be needed for the service being offered by the container. By default, containers should be denied instantiation when privileged system resources are requested and granted only after approval has been given. When access to privileged resources is necessary for a container, a new policy for execution should be written for the container. The default behavior must not give containers privileged access to host system resources. Examples of system resources that should be protected are kernel namespaces and host system sensitive directories such as /etc and /usr.

Description

Containers images instantiated within the container platform may request access to host system resources. Access to privileged resources can allow for unauthorized and unintended transfer of information, but in some cases, these resources may be needed for the service being offered by the container. By default, containers should be denied instantiation when privileged system resources are requested and granted only after approval has been given. When access to privileged resources is necessary for a container, a new policy for execution should be written for the container. The default behavior must not give containers privileged access to host system resources. Examples of system resources that should be protected are kernel namespaces and host system sensitive directories such as /etc and /usr.

STIG	Date
Container Platform Security Requirements Guide	2021-12-14

Details

Check Text ( C-36063r601752_chk )
Review documentation and configuration to determine if the container platform disallows instantiation of containers trying to access host system privileged resources. If the container platform does not block containers requesting host system privileged resources, this is a finding.

Fix Text (F-36031r600869_fix)
Configure the container platform to block instantiation of containers requesting access to host system-privileged resources.