search

sig-bsi-grundschutz / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://www.open-scap.org/security-policies/scap-security-guide
Other
7 stars 1 forks source link

SYS.1.6.A23 #23

Open sluetze opened 12 months ago

sluetze commented 3 months ago

Containers SHOULD not be able to change their file system at runtime.

This requirement must be implemented organizationally.

Note: By default, Red Hat recommends building containers so that the runtime UID does not have write permissions in the container. If the file system is changed (e.g. for a file system-based cache), this change will be lost when you restart, as the unchangeable image will be loaded again.

File systems SHOULD not be mounted with write permissions.

By default, local file systems are not mounted in containers. Containers access PVs that are integrated via OpenShift. This fulfills the requirement. Alternatively, ephemeral volumes can be used as volatile storage.

The container's root file system can be restricted to ReadOnly via the SecurityContext. Verification of this configuration can be carried out using ACS.

benruland commented 1 month ago

I would assess this control as manual.

For section 1, I totally agree with the pasted block and will use it 1:1.

For section 2, I would also suggest organizational implemention. However, I would lay the focus more on the ReadOnly via Security context AND the readOnly option on volumeMounts.

benruland commented 1 month ago

PR: https://github.com/ComplianceAsCode/content/pull/12470