Detections
Analytics

3.1.4 Ensure that the kubelet configuration file ownership is set to root:root

Information

Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root.

The kubelet reads various parameters, including security settings, from a config file specified by the --config argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be owned by root:root.

Solution

Run the following command (using the config file location identified in the Audit step):

chown root:root <kubelet_config_file>

Impact:

Overly permissive file access increases the security risk to the platform.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|5.2

Plugin: Unix

Control ID: caa6248606685c189ee91f682e008fb006c684104f8b700026e33549b34f33f4