Detections
Analytics

3.1.4 Ensure that the kubelet configuration file ownership is set to root:root

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Ensure that if the kubelet configuration file exists, it is owned by root:root.

The kubelet reads various parameters, including security settings, from a config file specified by the --config argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be owned by root:root.

Solution

Run the following command (using the config file location identified in the Audit step):

chown root:root <kubelet_config_file>

Impact:

Overly permissive file access increases the security risk to the platform.

See Also

https://workbench.cisecurity.org/benchmarks/24112

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|5.2

Plugin: Unix

Control ID: 145168d977e088bf55b3df41c304767927753f9cc227629966caf430bb12cca8