Control: 3.7 Ensure that registry certificate file ownership is set to root:root
Description
You should verify that all the registry certificate files (usually found under
/etc/docker/certs.d/<registry-name> directory) are individually owned and group
owned by root.
The /etc/docker/certs.d/<registry-name> directory contains Docker registry
certificates. These certificate files must be individually owned and group owned by root
to ensure that less privileged users are unable to modify the contents of the directory.
Remediation
The following command could be executed:
chown root:root /etc/docker/certs.d/<registry-name>/*
This would set the individual ownership and group ownership for the registry certificate files to root.
Default Value
By default, the individual ownership and group ownership for registry certificate files is
correctly set to root.
Usage
Run the control in your terminal:
powerpipe control run docker_compliance.control.cis_v160_3_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run docker_compliance.control.cis_v160_3_7 --shareSQL
This control uses a named query:
exec_ownership_root_root_registry_certificate