CIS Benchmarks -- Docker Hosts --3.8
amitaqua opened this issue · 4 comments
Seems we only check the first folder and not the whole deep path.
For example, I might have:
/etc/docker/cert.d/cdn.redhat.com/redhat-entitlement-authority.crt
So we only check the permissions on /etc/docker/cert.d/* and thus we see the permission on the subfolder but not on the file under that subfolder.
Hey ! You are very correct this is indeed an issue and that's why I opened a ticket about it to CIS https://workbench.cisecurity.org/benchmarks/4198/tickets/10849
We follow their books as much as possible, so we will wait until it will get answer from them
We got a reply: https://workbench.cisecurity.org/tickets/10896
Nice catch, what do you think of: find /etc/docker/certs.d/ -type f -exec stat -c "%a %n" {} ; and find /etc/docker/certs.d/ -type f -exec chmod 0444 {} ;
I've updated the recommendation.
For now, I will make a PR and update those changes but we won't approve it until those changes are official
Hi @yoavrotems - any updates regarding this one?
It seems it is not yet resolved based on my testing from the other day.
There is a solution (The draft PR mention in the above) but we want to wait for cis to update thier spec, but it seems to take them a while, maybe we should consider not wait? @lizrice