DKER-EE-001960 - Privileged Linux containers must not be used for Docker Enterprise.

Information

Using the --privileged flag gives all Linux Kernel Capabilities to the container thus overwriting the --cap-add and --cap-drop flags. Ensure that it is not used. The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

Solution

This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system and should be executed on all nodes in a Docker Enterprise cluster.

Do not run containers with the --privileged flag.

For example, do not start a container as below:

docker run --interactive --tty --privileged centos /bin/bash

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Docker_Enterprise_2-x_Linux-UNIX_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-235802r672378_rule, STIG-ID|DKER-EE-001960, STIG-Legacy|SV-104777, STIG-Legacy|V-95639, Vuln-ID|V-235802

Plugin: Unix

Control ID: da37dccc10f81963c8e6c5de6b2afca31b6d12a135c1add7a1749b03f45a05cd