Detections
Analytics
DKER-EE-002090 - Docker Enterprise exec commands must not be used with the user option.
Information
Do not docker exec with --user option.Using --user option in docker exec executes the command within the container as that user. Do not run docker exec with the --user option , especially when running containers with dropped capabilities or with enhanced restrictions. For example, suppose the container is running as tomcat user (or any other non-root user), it would be possible to run a command through docker exec as rootwith --user=root option.
By default, docker exec command runs without --user option.
Solution
This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.Do not use --user option in docker exec command.
A reference for the docker exec command can be found at https://docs.docker.com/engine/reference/commandline/exec/.
See Also
Item Details
Audit Name: DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-235814r960963_rule, STIG-ID|DKER-EE-002090, STIG-Legacy|SV-104801, STIG-Legacy|V-95663, Vuln-ID|V-235814
Plugin: Unix
Control ID: 5bb2cd5bcca744453777c5678c080904eb8ab05cde282c699d26c213cbae7617