1.8 Audit docker daemon

Information

Audit all Docker daemon activities.

Apart from auditing your regular Linux file system and system calls, audit Docker daemon
as well. Docker daemon runs with 'root' privileges. It is thus necessary to audit its activities
and usage.

Solution

Add a rule for Docker daemon.For example,Add the line as below line in /etc/audit/audit.rules file--w /usr/bin/docker -k dockerThen, restart the audit daemon. For example,#> service auditd restartImpact-Auditing generates quite big log files. Ensure to rotate and archive them periodically. Also,
create a separate partition of audit to avoid filling root file system.

Default Value-By default, Docker daemon is not audited.

See Also

https://workbench.cisecurity.org/files/514

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c.

Plugin: Unix

Control ID: 813ccf78e0cfc07c6ddab1b2eca696ab23d45c2f50309b3d35f7cc30ff3a0a68