Detections
Analytics

5.2.13 Minimize the admission of containers which have unmasked procmounts

Information

Do not generally permit containers which require the use of unmasked proc mounts

By default containers mask parts of the /proc filesystem which are mounted into the running container, to reduce the risk of container breakout. Kubernetes provides an option for proc to be mounted inside the container without masking to support specific use cases.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers which have unmasked procMount sections.

Impact:

Pods defined with unmasked procMount settings in either the container, initContainer or ephemeralContainer sections will not be permitted.

See Also

https://workbench.cisecurity.org/benchmarks/26886

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-7(5), 800-53|CM-10, 800-53|SI-7, 800-53|SI-7(1), CSCv7|12.4

Plugin: Unix

Control ID: b6b9c7bc292a67a52c27dd88e4eac4acba84ab0951a88b064db0665c21a6e43e