3.7 Ensure that registry certificate file ownership is set to root:root

Information

You should verify that all the registry certificate files (usually found under /etc/docker/certs.d/<registry-name> directory) are individually owned and group owned by root.

Rationale:

The /etc/docker/certs.d/<registry-name> directory contains Docker registry certificates. These certificate files must be individually owned and group owned by root to ensure that less privileged users are unable to modify the contents of the directory.

Impact:

None.

Solution

The following command could be executed:

chown root:root /etc/docker/certs.d/<registry-name>/*

This would set the individual ownership and group ownership for the registry certificate files to root.

Default Value:

By default, the individual ownership and group ownership for registry certificate files is correctly set to root.

See Also

https://workbench.cisecurity.org/benchmarks/11818