Detections
Analytics

DKER-EE-002090 - Docker Enterprise exec commands must not be used with the user option.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Do not docker exec with --user option.

Using --user option in docker exec executes the command within the container as that user. Do not run docker exec with the --user option , especially when running containers with dropped capabilities or with enhanced restrictions. For example, suppose the container is running as tomcat user (or any other non-root user), it would be possible to run a command through docker exec as rootwith --user=root option.

By default, docker exec command runs without --user option.

Solution

This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.

Do not use --user option in docker exec command.

A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-UNIX_V1R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CAT|II, CCI|CCI-000381, Rule-ID|SV-104801r2_rule, STIG-ID|DKER-EE-002090, Vuln-ID|V-95663

Plugin: Unix

Control ID: 4209fcd3f087499a3d3d3a553a7b220ff4d1497867fbb26ab3bfa874f8968a93