UCF STIG Viewer Logo

The container platform runtime must prohibit the instantiation of container images without explicit privileged status.


Overview

Finding ID Version Rule ID IA Controls Severity
V-233185 SRG-APP-000378-CTR-000885 SV-233185r601792_rule High
Description
Controlling access to those users and roles responsible for container image instantiation reduces the risk of untested or potentially malicious containers from being executed within the platform and on the hosting system. This access may be separate from the access required to install container images into the registry and those access requirements required to perform patch management and upgrades within the container platform. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.
STIG Date
Container Platform Security Requirements Guide 2021-12-14

Details

Check Text ( C-36121r601791_chk )
Review the container platform runtime configuration to determine if only accounts given specific container instantiation privileges can execute the container image instantiation process.

Attempt to instantiate a container image using an account that does not have the proper privileges to execute the process.

If container images can be instantiated using an account without the proper privileges, this is a finding.
Fix Text (F-36089r601043_fix)
Configure the container platform runtime to prohibit the instantiation of container images without explicit container image instantiation privileges given to users.