search

sig-bsi-grundschutz / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://www.open-scap.org/security-policies/scap-security-guide
Other
7 stars 0 forks source link

SYS.1.6.A21 #21

Open sluetze opened 10 months ago

sluetze commented 1 month ago

Advanced policies SHOULD limit container permissions.

By default, OpenShift blocks the containers' permissions (security-by-default).

Mandatory Access Control (MAC) or comparable technology SHOULD enforce these policies.

OpenShift already uses SELinux Mandatory Access Control to restrict permissions by default Using the Security Profiles Operator [SecurityProfile], workload-dependent SELinux and Seccomp profiles can be created and managed.

Policies SHOULD restrict at least the following access:

incoming and outgoing network connections,

file system accesses and

kernel requests (syscalls).

These permissions are managed in OpenShift and controlled via Security Context Constraints (SCCs). For tool-based policy management, ACS or Red Hat Advanced Cluster Management (ACM) (with Kyverno or Open Policy Agent) can be used.

The runtime SHOULD start the containers in such a way that the host system kernel prevents all activities of the containers that are not permitted by the policy (e.g. by setting up local packet filters or revoking permissions) or at least appropriately reports violations.

OpenShift already meets this requirement as standard (security-by-design).